PT-2019-18392 · Libvips+3 · Libvips+3

Publicado 2019-01-26 · Atualizado 2025-01-17 · CVE-2019-6976

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.7.4

Description The issue arises when libvips processes corrupted input image data, resulting in the generation of output images from uninitialized memory locations. This occurs because the allocated memory is not zeroed out in iofuncs/memory.c. As a consequence, raw process memory contents can be leaked through the output image.

Recommendations For versions prior to 8.7.4, update to version 8.7.4 or later to resolve the issue.

Correção

Use of Uninitialized Resource

Enumeração de Fraquezas

CWE-908

Identificadores relacionados

ALT-PU-2020-1098

ALT-PU-2020-2977

ALT-PU-2025-1396

CVE-2019-6976

USN-6437-1

Produtos afetados

Alt Linux

Linuxmint

Ubuntu

Libvips

Referências · 18

• https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a · Correção
• https://github.com/libvips/libvips/releases/tag/v8.7.4 · Nota
• https://t.me/cvenotify/58767 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2019-6976 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6976 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6976 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-40032 · Aviso do Fabricante
• https://t.me/defcon_news/11481 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2019-6976 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-6976 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7998 · Aviso do Fabricante
• https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6976 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-20739 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2021-27847 · Aviso do Fabricante