PT-2019-18392 · Libvips+3 · Libvips+3

Published 2019-01-26 · Updated 2025-01-17 · CVE-2019-6976

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.7.4

Description The issue arises when libvips processes corrupted input image data, resulting in the generation of output images from uninitialized memory locations. This occurs because the allocated memory is not zeroed out in iofuncs/memory.c. As a consequence, raw process memory contents can be leaked through the output image.

Recommendations For versions prior to 8.7.4, update to version 8.7.4 or later to resolve the issue.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALT-PU-2020-1098

ALT-PU-2020-2977

ALT-PU-2025-1396

CVE-2019-6976

USN-6437-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Libvips

References · 18

• https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a · Patch
• https://cve.org/CVERecord?id=CVE-2019-6976 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6976 · Security Note
• https://ubuntu.com/security/CVE-2023-40032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6976 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-6976 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7998 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6976 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-20739 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27847 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6437-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6976 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6437-1 · Vendor Advisory
• https://github.com/libvips/libvips/releases/tag/v8.7.4 · Note