Libvips
CVE-2020-20739
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
AnalysisAI
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified under CWE-909. im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address. Affected products include: Libvips, Debian Debian Linux, Fedoraproject Fedora. Version information: before 8.8.2.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate functio
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point
Memory corruption in libvips up to version 8.18.0 affects the matrix file loading functionality, allowing local attacker
A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file li
A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file li
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_he
Heap-based buffer overflow in libvips 8.19.0's vips_bandrank_build function can be triggered by manipulating the index a
Libvips up to version 8.18.0 contains a heap buffer overflow in the CSV parsing function that allows local attackers wit
A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conver
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecat
libvips is a demand-driven, horizontally threaded image processing library. Rated medium severity (CVSS 5.5), this vulne
Same weakness CWE-909 – Missing Initialization of Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today