CVE-2019-14973

Опубликовано: 14 авг. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html
Third Party Advisory
VDB Entry
https://gitlab.com/libtiff/libtiff/merge_requests/90
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00031.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/
https://seclists.org/bugtraq/2019/Nov/5
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/32
Mailing List
Third Party Advisory
https://www.debian.org/security/2020/dsa-4608
Third Party Advisory
https://www.debian.org/security/2020/dsa-4670
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html
Third Party Advisory
VDB Entry
https://gitlab.com/libtiff/libtiff/merge_requests/90
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00031.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/
https://seclists.org/bugtraq/2019/Nov/5
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/32
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

Версия до 4.0.10 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00725

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2019-14973

CVSS3: 6.5

ubuntu

около 6 лет назад

CVE-2019-14973

CVSS3: 4.5

redhat

около 6 лет назад

CVE-2019-14973

CVSS3: 6.5

debian

около 6 лет назад

_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through ...

openSUSE-SU-2020:1840-1

suse-cvrf

почти 5 лет назад

Security update for tiff

openSUSE-SU-2020:1561-1

suse-cvrf

почти 5 лет назад

Security update for tiff

EPSS

Процентиль: 72%

0.00725

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-190