PT-2019-1952 · Libtiff+2 · Libtiff+2

Zerokeeper · Published 2019-01-11 · Updated 2024-06-15 · CVE-2019-6128

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.0.10

Description The issue is related to a memory leak in the TIFFFdOpen function of the LibTIFF library, which can lead to uncontrolled memory allocation. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For LibTIFF version 4.0.10, consider applying a patch or updating to a newer version that fixes the memory leak issue in the TIFFFdOpen function. As a temporary workaround, restrict the use of the TIFFFdOpen function to minimize the risk of exploitation.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-399

CWE-401

Related Identifiers

BDU:2019-01642

CVE-2019-6128

DLA-2009-1

MGASA-2019-0075

OPENSUSE-SU-2019:1161-1

OPENSUSE-SU-2019_1161-1

OPENSUSE-SU-2024:11461-1

SUSE-SU-2019:0786-1

SUSE-SU-2019:14002-1

SUSE-SU-2019:3058-1

SUSE-SU-2019_14002-1

USN-3906-1

USN-3906-2

Affected Products

Libtiff

Suse

Ubuntu

References · 138

• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2836 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6128 · Security Note
• https://ubuntu.com/security/CVE-2018-10779 · Vendor Advisory
• https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-20482 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03213 · Security Note
• https://bdu.fstec.ru/vul/2020-03280 · Security Note
• https://ubuntu.com/security/notices/USN-3906-2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CXMZF6QHRSV4QSTQXM5RAXOWNJHAGFIW · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1161-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00196 · Security Note