{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "libpng16-16t64"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "libpng16-16t64",
                "from_version": {
                    "source_package_name": "libpng1.6",
                    "source_package_version": "1.6.47-1.1",
                    "version": "1.6.47-1.1"
                },
                "to_version": {
                    "source_package_name": "libpng1.6",
                    "source_package_version": "1.6.47-1.1ubuntu0.1",
                    "version": "1.6.47-1.1ubuntu0.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-64505",
                        "url": "https://ubuntu.com/security/CVE-2025-64505",
                        "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.",
                        "cve_priority": "medium",
                        "cve_public_date": "2025-11-25 00:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-64506",
                        "url": "https://ubuntu.com/security/CVE-2025-64506",
                        "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.",
                        "cve_priority": "medium",
                        "cve_public_date": "2025-11-25 00:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-64720",
                        "url": "https://ubuntu.com/security/CVE-2025-64720",
                        "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.",
                        "cve_priority": "medium",
                        "cve_public_date": "2025-11-25 00:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-65018",
                        "url": "https://ubuntu.com/security/CVE-2025-65018",
                        "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.",
                        "cve_priority": "medium",
                        "cve_public_date": "2025-11-25 00:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-64505",
                                "url": "https://ubuntu.com/security/CVE-2025-64505",
                                "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.",
                                "cve_priority": "medium",
                                "cve_public_date": "2025-11-25 00:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-64506",
                                "url": "https://ubuntu.com/security/CVE-2025-64506",
                                "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.",
                                "cve_priority": "medium",
                                "cve_public_date": "2025-11-25 00:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-64720",
                                "url": "https://ubuntu.com/security/CVE-2025-64720",
                                "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.",
                                "cve_priority": "medium",
                                "cve_public_date": "2025-11-25 00:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-65018",
                                "url": "https://ubuntu.com/security/CVE-2025-65018",
                                "cve_description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.",
                                "cve_priority": "medium",
                                "cve_public_date": "2025-11-25 00:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: buffer overflow issue",
                            "    - debian/patches/CVE-2025-64505.patch: Fix a buffer overflow in",
                            "      png_do_quantize",
                            "    - debian/patches/CVE-2025-64506.patch: Fix a heap buffer overflow in",
                            "      png_write_image_8bit",
                            "    - debian/patches/CVE-2025-64720.patch: Fix a buffer overflow in",
                            "      png_init_read_transformations",
                            "    - debian/patches/CVE-2025-65018.patch: Fix a heap buffer overflow in",
                            "      png_image_finish_read",
                            "    - CVE-2025-64505",
                            "    - CVE-2025-64506",
                            "    - CVE-2025-64720",
                            "    - CVE-2025-65018",
                            ""
                        ],
                        "package": "libpng1.6",
                        "version": "1.6.47-1.1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "plucky-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Nishit Majithia <nishit.majithia@canonical.com>",
                        "date": "Tue, 09 Dec 2025 17:37:55 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 25.04 plucky image from daily image serial 20251210 to 20251211",
    "from_series": "plucky",
    "to_series": "plucky",
    "from_serial": "20251210",
    "to_serial": "20251211",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}