CVE-2015-8126: apple mac_os_x

Modified

AliasesMGASA-2015-0451SUSE-SU-2015:2013-1SUSE-SU-2016:0027-1+4 more

Published 13-11-2015Last modified 14-10-2026

Vulnerability summary

CVE-2015-8126 is a high (CVSS 7.5) vulnerability in apple mac_os_x. EPSS estimates a 10.34% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

10.34%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

13-11-2015
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

10.34%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Suse30 products

libpng12-0&distro=SUSE Linux Enterprise Desktop 11 SP3< 1.2.31-5.38.1
libpng12-0&distro=SUSE Linux Enterprise Desktop 11 SP4< 1.2.31-5.38.1
libpng12-0&distro=SUSE Linux Enterprise Server 11 SP3< 1.2.31-5.38.1
libpng12-0&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 1.2.31-5.38.1
libpng12-0&distro=SUSE Linux Enterprise Server 11 SP4< 1.2.31-5.38.1

Show all 30

Redhat7 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6 | 7.7
enterprise_linux_server_tus7.2 | 7.3 | 7.6 | 7.7

Show all 7

Oracle4 products

jdk1.6.0:update105 | 1.7.0:update91 | 1.8.0:update65 | 1.8.0:update66
jre1.6.0:update105 | 1.7.0:update91 | 1.8.0:update65 | 1.8.0:update66
linuxEOL6 | 7
solarisEOL11.3

Mageia2 products

libpng< 1.6.19-1.mga5
libpng12< 1.2.54-1.mga5

Opensuse2 products

leapEOL42.1
opensuseEOL13.1 | 13.2

Apple1 product

mac_os_x< 10.11.4

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10

Debian1 product

debian_linuxEOL7.0 | 8.0 | 9.0

Fedoraproject1 product

fedoraEOL21 | 22 | 23

Libpng1 product

libpng< 1.0.64 | ≥ 1.1.1, < 1.2.54 | ≥ 1.3.0, < 1.4.17 | ≥ 1.5.0, < 1.5.24 | ≥ 1.6.0, < 1.6.19

Ubuntu1 product

libpng< 1.2.50-1ubuntu2.14.04.1

11 vendors · 51 products

References

71 links

lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-01/msg00028.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
support.apple.com/HT206167X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-11/msg00159.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-11/msg00160.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.securityfocus.com/bid/77568VDB EntryX Refsource BIDThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory

Show all 71 references

lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
security.gentoo.org/glsa/201611-08Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.debian.org/security/2016/dsa-3507Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securitytracker.com/id/1034142VDB EntryX Refsource SECTRACKThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2016:1430Vendor AdvisoryX Refsource REDHATThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.debian.org/security/2015/dsa-3399Vendor AdvisoryX Refsource DEBIANThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-2595.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-2596.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00062.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10148X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2015/11/12/2Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-01/msg00030.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
security.gentoo.org/glsa/201603-09Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00063.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0057.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0055.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.ubuntu.com/usn/USN-2815-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0056.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-2594.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
code.google.com/p/chromium/issues/detail?id=560291X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
googlechromereleases.blogspot.com/2016/03/stable-channel-update.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-01/msg00029.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
advisories.mageia.org/MGASA-2015-0451.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=17161REPORT
openwall.com/lists/oss-security/2015/11/13/1WEB
www.suse.com/support/update/announcement/2015/suse-su-20152013-1/Advisory
bugzilla.suse.com/954980REPORT
www.suse.com/security/cve/CVE-2015-8126WEB
www.suse.com/support/update/announcement/2016/suse-su-20160027-1/Advisory
www.suse.com/support/update/announcement/2016/suse-su-20160041-1/Advisory
www.suse.com/support/update/announcement/2016/suse-su-20160050-1/Advisory
www.suse.com/support/update/announcement/2016/suse-su-20160061-1/Advisory
ubuntu.com/security/CVE-2015-8126REPORT
ubuntu.com/security/notices/USN-2815-1Advisory
bugzilla.mozilla.org/show_bug.cgi?id=1224244REPORT
www.cve.org/CVERecord?id=CVE-2015-8126REPORT
nvd.nist.gov/vuln/detail/CVE-2015-8126OvalAdvisory