PT-2019-5048 · Gnome+8 · Gnome Evince+8
Andy Nguyen
·
Published
2019-04-13
·
Updated
2025-02-18
·
CVE-2019-11459
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNOME Evince versions prior to 3.32.0
Description
The issue is related to the use of uninitialized memory in the TIFFReadRGBAImageOriented function of the Evince document viewer. This can be exploited by a remote attacker to gain unauthorized access to information. The tiff document render() and tiff document get thumbnail() functions in the TIFF document backend did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.
Recommendations
For versions prior to 3.32.0, update to version 3.32.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the TIFFReadRGBAImageOriented function until a patch is available. Restrict access to TIFF image files to minimize the risk of exploitation.
Exploit
Fix
Access of Uninitialized Pointer
Improper Check for Exceptional Conditions
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Gnome Evince
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu