PT-2019-1952 · Libtiff+2 · Libtiff+2

Zerokeeper · Publicado 2019-01-11 · Atualizado 2024-06-15 · CVE-2019-6128

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.0.10

Description The issue is related to a memory leak in the TIFFFdOpen function of the LibTIFF library, which can lead to uncontrolled memory allocation. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For LibTIFF version 4.0.10, consider applying a patch or updating to a newer version that fixes the memory leak issue in the TIFFFdOpen function. As a temporary workaround, restrict the use of the TIFFFdOpen function to minimize the risk of exploitation.

Exploit

Correção

Memory Leak

Enumeração de Fraquezas

CWE-399

CWE-401

Identificadores relacionados

BDU:2019-01642

CVE-2019-6128

DLA-2009-1

MGASA-2019-0075

OPENSUSE-SU-2019:1161-1

OPENSUSE-SU-2019_1161-1

OPENSUSE-SU-2024:11461-1

SUSE-SU-2019:0786-1

SUSE-SU-2019:14002-1

SUSE-SU-2019:3058-1

SUSE-SU-2019_14002-1

USN-3906-1

USN-3906-2

Produtos afetados

Libtiff

Suse

Ubuntu

Referências · 138

• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2836 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6128 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-10269 · Nota
• https://ubuntu.com/security/CVE-2018-10779 · Aviso do Fabricante
• https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-20482 · Nota de Segurança
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-201914002-1 · Nota
• https://suse.com/security/cve/CVE-2016-10272 · Nota
• https://bdu.fstec.ru/vul/2020-03213 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-03280 · Nota de Segurança
• http://bugzilla.maptools.org/show_bug.cgi?id=2798 · Nota
• https://suse.com/security/cve/CVE-2016-10271 · Nota
• https://ubuntu.com/security/notices/USN-3906-2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-6128 · Nota