PT-2023-27226 · Libvips+3 · Libvips+3

Christopher Krah · Publicado 2020-10-08 · Atualizado 2025-04-21 · CVE-2023-40032

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvips versions 8.14.3 or earlier

Description A specially crafted SVG input can cause libvips to segfault when attempting to parse a malformed UTF-8 character. libvips is a demand-driven, horizontally threaded image processing library.

Recommendations For libvips versions 8.14.3 or earlier, upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2020-2977

ALT-PU-2024-5975

CVE-2023-40032

GHSA-33QP-9PQ7-9584

USN-6437-1

Produtos afetados

Alt Linux

Linuxmint

Ubuntu

Libvips

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40032.json · Exploit
• https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582b · Correção
• https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584 · Aviso do Fabricante
• https://github.com/libvips/libvips/pull/3604 · Correção
• https://t.me/cvenotify/119132 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2019-6976 · Aviso do Fabricante
• https://t.me/cvenotify/69035 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2023-40032 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7998 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-40032 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6437-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2021-27847 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6437-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-20739 · Aviso do Fabricante