PT-2023-27226 · Libvips+3 · Libvips+3

Christopher Krah · Published 2020-10-08 · Updated 2025-04-21 · CVE-2023-40032

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvips versions 8.14.3 or earlier

Description A specially crafted SVG input can cause libvips to segfault when attempting to parse a malformed UTF-8 character. libvips is a demand-driven, horizontally threaded image processing library.

Recommendations For libvips versions 8.14.3 or earlier, upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2020-2977

ALT-PU-2024-5975

CVE-2023-40032

GHSA-33QP-9PQ7-9584

USN-6437-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Libvips

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40032.json · Exploit
• https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582b · Patch
• https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584 · Vendor Advisory
• https://github.com/libvips/libvips/pull/3604 · Patch
• https://ubuntu.com/security/CVE-2019-6976 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40032 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YU2FFC47X2XDEGEHEWAGLU5L3R6FEYD2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6437-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27847 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6437-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-20739 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40032 · Security Note