CVE-2020-19131
published 2021-09-07CVE-2020-19131: Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.26%
80.8th percentile
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | tiff | < tiff 4.0.10+git190814-1 (bookworm) | tiff 4.0.10+git190814-1 (bookworm) |
| simplesystems | libtiff | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
LibTIFF vulnerabilities
vendor_ubuntu·2022-09-20·CVSS 7.5
CVE-2020-19144 [HIGH] LibTIFF vulnerabilities
Title: LibTIFF vulnerabilities
Summary: Several security issues were fixed in LibTIFF.
It was discovered that LibTIFF was not properly performing the calculation
of data that would eventually be used as a reference for bound-checking
operations. An attacker could possibly use this issue to cause a denial of
service or to expose sensitive information. This issue only affected Ubuntu
18.04 LTS. (CVE-2020-19131)
It was discovered that LibTIFF was not properly terminating a function
execution when processing incorrect data. An attacker could possibly use
this issue to cause a denial of service or to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2020-19144)
It was discovered that LibTIFF did not properly manage memory under certain
circumstances. If a user we
Ubuntu
LibTIFF vulnerabilities
vendor_ubuntu·2022-09-12·CVSS 7.5
CVE-2022-0907 [HIGH] LibTIFF vulnerabilities
Title: LibTIFF vulnerabilities
Summary: Several security issues were fixed in LibTIFF.
USN-5523-1 fixed several vulnerabilities in LibTIFF. This update
provides the fixes for CVE-2022-0907, CVE-2022-0908, CVE-2022-0909,
CVE-2022-0924 and CVE-2022-22844 for Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that LibTIFF was not properly perf orming checks to
guarantee that allocated memory space existed, which could lead to a
NULL pointer dereference via a specially crafted file. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2022-0907, CVE-2022-0908)
It was discovered that LibTIFF was not properly performing checks to
avoid division calculations where the denominator value was zero,
which could lead to an undefined behavio
Ubuntu
LibTIFF vulnerabilities
vendor_ubuntu·2022-07-19·CVSS 7.5
CVE-2020-19144 [HIGH] LibTIFF vulnerabilities
Title: LibTIFF vulnerabilities
Summary: Several security issues were fixed in LibTIFF.
It was discovered that LibTIFF was not properly performing checks to
guarantee that allocated memory space existed, which could lead to a
NULL pointer dereference via a specially crafted file. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2022-0907, CVE-2022-0908)
It was discovered that LibTIFF was not properly performing checks to
avoid division calculations where the denominator value was zero,
which could lead to an undefined behavior situation via a specially
crafted file. An attacker could possibly use this issue to cause a
denial of service. (CVE-2022-0909)
It was discovered that LibTIFF was not properly performing bounds
checks, which could lead to an out-of-boun
Red Hat
libtiff: a buffer overflow via the "invertImage()" may lead to DoS
vendor_redhat·2021-09-07·CVSS 7.5
CVE-2020-19131 [HIGH] CWE-119 libtiff: a buffer overflow via the "invertImage()" may lead to DoS
libtiff: a buffer overflow via the "invertImage()" may lead to DoS
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
The libtiff package is susceptible to a heap/buffer overflow via the "invertImage()" which may lead to a DoS.
The highest threat from this vulnerability is to system availability.
Package: libtiff (Red Hat Enterprise Linux 6) - Out of support scope
Package: compat-libtiff3 (Red Hat Enterprise Linux 7) - Not affected
Package: libtiff (Red Hat Enterprise Linux 7) - Will not fix
Package: compat-libtiff3 (Red Hat Enterprise Linux 8) - Not affected
Package: mingw-libtiff (Red Hat Enterprise Linux 8) - Will not fix
Package: libtiff (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2020-19131: tiff - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service...
vendor_debian·2020·CVSS 7.5
CVE-2020-19131 [HIGH] CVE-2020-19131: tiff - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service...
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Scope: local
bookworm: resolved (fixed in 4.0.10+git190814-1)
bullseye: resolved (fixed in 4.0.10+git190814-1)
forky: resolved (fixed in 4.0.10+git190814-1)
sid: resolved (fixed in 4.0.10+git190814-1)
trixie: resolved (fixed in 4.0.10+git190814-1)
OSV
tiff vulnerabilities
osv·2022-09-20·CVSS 7.5
CVE-2020-19131 [HIGH] tiff vulnerabilities
tiff vulnerabilities
It was discovered that LibTIFF was not properly performing the calculation
of data that would eventually be used as a reference for bound-checking
operations. An attacker could possibly use this issue to cause a denial of
service or to expose sensitive information. This issue only affected Ubuntu
18.04 LTS. (CVE-2020-19131)
It was discovered that LibTIFF was not properly terminating a function
execution when processing incorrect data. An attacker could possibly use
this issue to cause a denial of service or to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2020-19144)
It was discovered that LibTIFF did not properly manage memory under certain
circumstances. If a user were tricked into opening a specially crafted TIFF
file using tiffinf
OSV
tiff vulnerabilities
osv·2022-09-12·CVSS 7.5
CVE-2022-0907 [HIGH] tiff vulnerabilities
tiff vulnerabilities
USN-5523-1 fixed several vulnerabilities in LibTIFF. This update
provides the fixes for CVE-2022-0907, CVE-2022-0908, CVE-2022-0909,
CVE-2022-0924 and CVE-2022-22844 for Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that LibTIFF was not properly perf orming checks to
guarantee that allocated memory space existed, which could lead to a
NULL pointer dereference via a specially crafted file. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2022-0907, CVE-2022-0908)
It was discovered that LibTIFF was not properly performing checks to
avoid division calculations where the denominator value was zero,
which could lead to an undefined behavior situation via a specially
crafted file. An attacker could possibl
OSV
tiff vulnerabilities
osv·2022-07-19·CVSS 7.5
CVE-2022-0907 [HIGH] tiff vulnerabilities
tiff vulnerabilities
It was discovered that LibTIFF was not properly performing checks to
guarantee that allocated memory space existed, which could lead to a
NULL pointer dereference via a specially crafted file. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2022-0907, CVE-2022-0908)
It was discovered that LibTIFF was not properly performing checks to
avoid division calculations where the denominator value was zero,
which could lead to an undefined behavior situation via a specially
crafted file. An attacker could possibly use this issue to cause a
denial of service. (CVE-2022-0909)
It was discovered that LibTIFF was not properly performing bounds
checks, which could lead to an out-of-bounds read via a specially
crafted file. An attacker could possibly us
GHSA
GHSA-2hvg-v2h5-m85r: Buffer Overflow in LibTiff v4
ghsa_unreviewed·2022-05-24
CVE-2020-19131 [HIGH] CWE-787 GHSA-2hvg-v2h5-m85r: Buffer Overflow in LibTiff v4
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
OSV
CVE-2020-19131: Buffer Overflow in LibTiff v4
osv·2021-09-07·CVSS 7.5
CVE-2020-19131 [HIGH] CVE-2020-19131: Buffer Overflow in LibTiff v4
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/http://bugzilla.maptools.org/show_bug.cgi?id=2831https://lists.debian.org/debian-lts-announce/2021/10/msg00004.htmlhttp://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/http://bugzilla.maptools.org/show_bug.cgi?id=2831https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
2021-09-07
Published