CVE-2020-20739
published 2020-11-20CVE-2020-20739: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.98%
78.6th percentile
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | vips | < vips 8.9.0-1 (bookworm) | vips 8.9.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| libvips | libvips | < 8.8.2 | 8.8.2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
vips vulnerabilities
osv·2023-10-18·CVSS 7.5
CVE-2018-7998 [HIGH] vips vulnerabilities
vips vulnerabilities
Ziqiang Gu discovered that VIPS could be made to dereference a NULL
pointer. If a user or automated system were tricked into processing
a specially crafted input image file, an attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)
It was discovered that VIPS did not properly handle uninitialized memory
locations when processing corrupted input image data. An attacker could
possibly use this issue to generate output images that expose sensitive
information. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 18.04 LTS. (CVE-2019-6976)
It was discovered that VIPS did not properly manage memory due to an
uninitialized variable. If a user or automated system were tricked into
GHSA
GHSA-62hp-w5vm-g7xm: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz
ghsa_unreviewed·2022-05-24
CVE-2020-20739 [MEDIUM] CWE-908 GHSA-62hp-w5vm-g7xm: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
OSV
CVE-2020-20739: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz
osv·2020-11-20·CVSS 5.3
CVE-2020-20739 [MEDIUM] CVE-2020-20739: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Ubuntu
VIPS vulnerabilities
vendor_ubuntu·2023-10-18·CVSS 7.5
CVE-2020-20739 [HIGH] VIPS vulnerabilities
Title: VIPS vulnerabilities
Summary: Several security issues were fixed in VIPS.
Ziqiang Gu discovered that VIPS could be made to dereference a NULL
pointer. If a user or automated system were tricked into processing
a specially crafted input image file, an attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)
It was discovered that VIPS did not properly handle uninitialized memory
locations when processing corrupted input image data. An attacker could
possibly use this issue to generate output images that expose sensitive
information. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 18.04 LTS. (CVE-2019-6976)
It was discovered that VIPS did not properly manage memory due to an
uninitiali
Debian
CVE-2020-20739: vips - im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 h...
vendor_debian·2020·CVSS 5.3
CVE-2020-20739 [MEDIUM] CVE-2020-20739: vips - im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 h...
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Scope: local
bookworm: resolved (fixed in 8.9.0-1)
bullseye: resolved (fixed in 8.9.0-1)
forky: resolved (fixed in 8.9.0-1)
sid: resolved (fixed in 8.9.0-1)
trixie: resolved (fixed in 8.9.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Missing Initialization of a Variable
mitre_cwe
CWE-456 Missing Initialization of a Variable
CWE-456: Missing Initialization of a Variable
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Other. Impact: Unexpected State, Quality Degradation, Varies by Context. The uninitialized data may be invalid, causing logic errors within the program. In some cases, this could result in a security problem.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, th
CWE
Missing Initialization of Resource
mitre_cwe
CWE-909 Missing Initialization of Resource
CWE-909: Missing Initialization of Resource
The product does not initialize a critical resource.
Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. The uninitialized resource may
https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031ahttps://github.com/libvips/libvips/issues/1419https://lists.debian.org/debian-lts-announce/2020/11/msg00049.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQCXFYBUXEM7UXJAOKLSP/https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031ahttps://github.com/libvips/libvips/issues/1419https://lists.debian.org/debian-lts-announce/2020/11/msg00049.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQCXFYBUXEM7UXJAOKLSP/
2020-11-20
Published