testwhitesource's Introduction
testwhitesource's People
Contributors
![mend-bolt-for-github[bot] avatar](https://avatars.githubusercontent.com/in/16809?v=4 "mend-bolt-for-github[bot]")
Watchers
Forkers
skywf10testwhitesource's Issues
Bento4v1.5.0-617: 56 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Vulnerable Source Files (2)
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2018-13846 |  High |
9.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14532 | High |
9.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2017-14639 | High |
8.8 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2019-15048 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-15049 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-8378 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2021-32265 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14587 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-8380 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14589 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14586 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14585 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-8382 | High |
8.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-17530 | High |
7.8 | multiple | Direct | N/A | ❌ |
| CVE-2018-5253 | High |
7.8 | Bento4v1.5.0-617 | Direct | v1.5.1-623 | ❌ |
| CVE-2017-14261 | High |
7.8 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2017-14259 | High |
7.8 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2017-14258 | High |
7.8 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-17529 | High |
7.8 | multiple | Direct | N/A | ❌ |
| CVE-2019-6132 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-23331 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-23332 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-23330 | High |
7.5 | multiple | Direct | v1.6.0-635 | ❌ |
| CVE-2020-23333 | High |
7.5 | Bento4v1.5.0-617 | Direct | v1.6.0-635 | ❌ |
| CVE-2020-23334 | High |
7.5 | Bento4v1.5.0-617 | Direct | v1.6.0-635 | ❌ |
| CVE-2019-13238 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14588 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-17528 | High |
7.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-10790 | High |
7.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-17454 |  Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2019-17453 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2021-35307 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2021-35306 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-21066 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-13959 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-19717 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-20502 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | v1.5.1-629 | ❌ |
| CVE-2019-6966 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-20186 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-19719 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-19718 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-7699 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2017-14645 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2017-14643 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2017-14641 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | v1.5.0-618 | ❌ |
| CVE-2020-19722 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-19721 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-19720 | Medium |
6.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-17452 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-31282 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2022-31287 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2020-23912 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | v0.27.4 | ❌ |
| CVE-2021-40943 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2019-16349 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | N/A | ❌ |
| CVE-2018-14544 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | v1.5.1-626 | ❌ |
| CVE-2018-14545 | Medium |
5.5 | Bento4v1.5.0-617 | Direct | v1.5.1-626 | ❌ |
Details
Partial details (28 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2018-13846
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue has been found in Bento4 1.5.1-624. AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp has a heap-based buffer over-read after a call from Mp42Ts.cpp, a related issue to CVE-2018-14532.
Publish Date: 2018-07-10
URL: CVE-2018-13846
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14532
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in Bento4 1.5.1-624. There is a heap-based buffer over-read in AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp after a call from Mp42Hls.cpp, a related issue to CVE-2018-13846.
Publish Date: 2018-07-23
URL: CVE-2018-14532
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2017-14639
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service (application crash) or possibly unspecified other impact.
Publish Date: 2017-09-21
URL: CVE-2017-14639
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14639
Release Date: 2017-09-21
Fix Resolution: v1.5.0-618
Step up your Open Source Security Game with Mend here
CVE-2019-15048
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.
Publish Date: 2019-08-14
URL: CVE-2019-15048
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-15049
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.
Publish Date: 2019-08-14
URL: CVE-2019-15049
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-8378
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4_BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Publish Date: 2019-02-17
URL: CVE-2019-8378
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2021-32265
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in Bento4 through v1.6.0-637. A global-buffer-overflow exists in the function AP4_MemoryByteStream::WritePartial() located in Ap4ByteStream.cpp. It allows an attacker to cause code execution or information disclosure.
Publish Date: 2021-09-20
URL: CVE-2021-32265
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14587
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue has been discovered in Bento4 1.5.1-624. AP4_MemoryByteStream::WritePartial in Core/Ap4ByteStream.cpp has a buffer over-read.
Publish Date: 2018-07-24
URL: CVE-2018-14587
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-8380
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in AP4_Track::GetSampleIndexForTimeStampMs() located in Core/Ap4Track.cpp. It can triggered by sending a crafted file to the mp4audioclip binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Publish Date: 2019-02-17
URL: CVE-2019-8380
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14589
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue has been discovered in Bento4 1.5.1-624. AP4_Mp4AudioDsiParser::ReadBits in Codecs/Ap4Mp4AudioInfo.cpp has a heap-based buffer over-read.
Publish Date: 2018-07-24
URL: CVE-2018-14589
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14586
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue has been discovered in Bento4 1.5.1-624. A SEGV can occur in AP4_Mpeg2TsAudioSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp, a different vulnerability than CVE-2018-14532.
Publish Date: 2018-07-24
URL: CVE-2018-14586
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14585
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a heap-based buffer over-read after a call from the AP4_Stz2Atom class.
Publish Date: 2018-07-24
URL: CVE-2018-14585
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-8382
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in the function AP4_List:Find located in Core/Ap4List.h when called from Core/Ap4Movie.cpp. It can be triggered by sending a crafted file to the mp4dump binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Publish Date: 2019-02-17
URL: CVE-2019-8382
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-17530
Vulnerable Libraries - Bento4v1.5.0-617, Bento4v1.5.0-617
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
Publish Date: 2019-10-12
URL: CVE-2019-17530
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-5253
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.
Publish Date: 2018-01-05
URL: CVE-2018-5253
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5253
Release Date: 2018-01-05
Fix Resolution: v1.5.1-623
Step up your Open Source Security Game with Mend here
CVE-2017-14261
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In the SDK in Bento4 1.5.0-616, the AP4_StszAtom class in Ap4StszAtom.cpp file contains a Read Memory Access Violation vulnerability. It is possible to exploit this vulnerability by opening a crafted .MP4 file.
Publish Date: 2017-09-11
URL: CVE-2017-14261
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14261
Release Date: 2017-09-11
Fix Resolution: v1.5.0-618
Step up your Open Source Security Game with Mend here
CVE-2017-14259
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In the SDK in Bento4 1.5.0-616, the AP4_StscAtom class in Ap4StscAtom.cpp contains a Write Memory Access Violation vulnerability. It is possible to exploit this vulnerability and possibly execute arbitrary code by opening a crafted .MP4 file.
Publish Date: 2017-09-11
URL: CVE-2017-14259
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14259
Release Date: 2017-09-11
Fix Resolution: v1.5.0-618
Step up your Open Source Security Game with Mend here
CVE-2017-14258
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In the SDK in Bento4 1.5.0-616, SetItemCount in Core/Ap4StscAtom.h file contains a Write Memory Access Violation vulnerability. It is possible to exploit this vulnerability and possibly execute arbitrary code by opening a crafted .MP4 file.
Publish Date: 2017-09-11
URL: CVE-2017-14258
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-17529
Vulnerable Libraries - Bento4v1.5.0-617, Bento4v1.5.0-617
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
Publish Date: 2019-10-12
URL: CVE-2019-17529
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-6132
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp when called from the AP4_EsdsAtom class in Core/Ap4EsdsAtom.cpp, as demonstrated by mp42aac.
Publish Date: 2019-01-11
URL: CVE-2019-6132
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2020-23331
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Descriptor.h. It allows an attacker to cause a denial of service (DOS).
Publish Date: 2021-08-17
URL: CVE-2020-23331
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2020-23332
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9. This issue can lead to a denial of service (DOS).
Publish Date: 2021-08-17
URL: CVE-2020-23332
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2020-23330
Vulnerable Libraries - Bento4v1.5.0-617, Bento4v1.5.0-617
Vulnerability Details
An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom.cpp. It allows an attacker to cause a denial of service (DOS).
Publish Date: 2021-08-17
URL: CVE-2020-23330
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23330
Release Date: 2021-08-17
Fix Resolution: v1.6.0-635
Step up your Open Source Security Game with Mend here
CVE-2020-23333
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).
Publish Date: 2021-08-17
URL: CVE-2020-23333
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23333
Release Date: 2021-08-17
Fix Resolution: v1.6.0-635
Step up your Open Source Security Game with Mend here
CVE-2020-23334
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault.
Publish Date: 2021-08-17
URL: CVE-2020-23334
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23334
Release Date: 2021-08-17
Fix Resolution: v1.6.0-635
Step up your Open Source Security Game with Mend here
CVE-2019-13238
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL pointer.
Publish Date: 2019-07-04
URL: CVE-2019-13238
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-14588
Vulnerable Library - Bento4v1.5.0-617
Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
Library home page: https://github.com/axiomatic-systems/Bento4.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
An issue has been discovered in Bento4 1.5.1-624. A NULL pointer dereference can occur in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.
Publish Date: 2018-07-24
URL: CVE-2018-14588
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2019-17528
Vulnerable Libraries - Bento4v1.5.0-617, Bento4v1.5.0-617
Vulnerability Details
An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom::SetDefaultSampleSize at Core/Ap4TfhdAtom.h when called from AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp.
Publish Date: 2019-10-12
URL: CVE-2019-17528
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
sulinosversion-2.0.16: 10 vulnerabilities (highest severity is: 8.8)
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2015-8751 | High |
8.8 | sulinosversion-2.0.16 | Direct | N/A | ❌ |
| CVE-2018-19543 | High |
7.8 | sulinosversion-2.0.16 | Direct | N/A | ❌ |
| CVE-2021-26926 | High |
7.1 | sulinosversion-2.0.16 | Direct | version-2.0.25 | ❌ |
| CVE-2021-3467 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | 2.0.26 | ❌ |
| CVE-2021-3443 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | 2.0.27 | ❌ |
| CVE-2021-26927 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | version-2.0.25 | ❌ |
| CVE-2017-5504 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | version-2.0.17 | ❌ |
| CVE-2017-5505 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | version-2.0.17 | ❌ |
| CVE-2021-3272 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | jasper-utils-debuginfo - 2.0.14-5,2.0.14-5;jasper - 2.0.14-5;jasper-debuginfo - 2.0.14-5;jasper-debugsource - 2.0.14-5,2.0.14-5;jasper-libs - 2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5;jasper-libs-debuginfo - 2.0.14-5,2.0.14-5 | ❌ |
| CVE-2018-18873 | Medium |
5.5 | sulinosversion-2.0.16 | Direct | libjasper-dev - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-1.701-1 - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-1.701-dev - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-runtime - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper1 - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3 | ❌ |
Details
CVE-2015-8751
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
Publish Date: 2020-02-17
URL: CVE-2015-8751
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-19543
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.
Publish Date: 2018-11-26
URL: CVE-2018-19543
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2021-26926
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash.
Publish Date: 2021-02-23
URL: CVE-2021-26926
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26926
Release Date: 2021-02-23
Fix Resolution: version-2.0.25
Step up your Open Source Security Game with Mend here
CVE-2021-3467
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Publish Date: 2021-03-25
URL: CVE-2021-3467
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3467
Release Date: 2021-03-25
Fix Resolution: 2.0.26
Step up your Open Source Security Game with Mend here
CVE-2021-3443
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Publish Date: 2021-03-25
URL: CVE-2021-3443
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-03-16
Fix Resolution: 2.0.27
Step up your Open Source Security Game with Mend here
CVE-2021-26927
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.
Publish Date: 2021-02-23
URL: CVE-2021-26927
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26927
Release Date: 2021-02-23
Fix Resolution: version-2.0.25
Step up your Open Source Security Game with Mend here
CVE-2017-5504
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-01
URL: CVE-2017-5504
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5504
Release Date: 2017-03-01
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2017-5505
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-16
URL: CVE-2017-5505
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5505
Release Date: 2017-03-16
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2021-3272
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
Publish Date: 2021-01-27
URL: CVE-2021-3272
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3272
Release Date: 2021-01-27
Fix Resolution: jasper-utils-debuginfo - 2.0.14-5,2.0.14-5;jasper - 2.0.14-5;jasper-debuginfo - 2.0.14-5;jasper-debugsource - 2.0.14-5,2.0.14-5;jasper-libs - 2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5;jasper-libs-debuginfo - 2.0.14-5,2.0.14-5
Step up your Open Source Security Game with Mend here
CVE-2018-18873
Vulnerable Library - sulinosversion-2.0.16
Indipendent distro uses inary package system. Sulin is roolling donkey
Library home page: https://sourceforge.net/projects/sulinos/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.
Publish Date: 2018-10-31
URL: CVE-2018-18873
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-18873
Release Date: 2018-10-31
Fix Resolution: libjasper-dev - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-1.701-1 - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-1.701-dev - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper-runtime - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3;libjasper1 - 1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3,1.900.1-debian1-2.4ubuntu1.3
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 30 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-2057 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-2058 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-2056 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-34266 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.4.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
Partial details (29 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2022-2057
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2057
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-2058
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2058
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-2056
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2056
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-34266
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
Publish Date: 2022-07-19
URL: CVE-2022-34266
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html
Release Date: 2022-07-19
Fix Resolution: v4.4.0
Step up your Open Source Security Game with Mend here
binutilsbinutils-2.38: 68 vulnerabilities (highest severity is: 7.8)
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2018-6323 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_31 | ❌ |
| CVE-2021-20294 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_35_2 | ❌ |
| CVE-2021-45078 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils - 2.37.50.20220106-1 | ❌ |
| CVE-2017-12456 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_30 | ❌ |
| CVE-2017-12454 | High |
7.8 | multiple | Direct | binutils - 2.29-9,2.29-9,2.29-9 | ❌ |
| CVE-2017-12455 | High |
7.8 | multiple | Direct | binutils - 2.29-8,2.29-8,2.29-8 | ❌ |
| CVE-2017-12453 | High |
7.8 | multiple | Direct | binutils - 2.29-9,2.29-9,2.29-9 | ❌ |
| CVE-2019-1010180 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_32,gdb-8.3-release | ❌ |
| CVE-2017-12450 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2018-19931 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils - 2.32-1 | ❌ |
| CVE-2017-12458 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_29_1 | ❌ |
| CVE-2017-14745 | High |
7.8 | multiple | Direct | binutils-2_30 | ❌ |
| CVE-2017-15996 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2018-1000876 | High |
7.8 | multiple | Direct | binutils-devel - 2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base;binutils-debuginfo - 2.27-41.base,2.27-41.base;binutils - 2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base | ❌ |
| CVE-2017-12448 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils-2_30,gdb-8.1-release,users/ARM/embedded-binutils-2_30-branch-2018q2 | ❌ |
| CVE-2017-14333 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils - 2.29-9,2.29-9,2.29-9 | ❌ |
| CVE-2017-17125 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-16831 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-16832 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-12799 | High |
7.8 | binutilsbinutils-2.38 | Direct | binutils - 2.29-9,2.29-9,2.29-9 | ❌ |
| CVE-2017-17121 | High |
7.8 | multiple | Direct | 2.30 | ❌ |
| CVE-2017-17122 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-17124 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-15020 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-16827 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-16829 | High |
7.8 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-14729 | High |
7.8 | multiple | Direct | binutils-2_30 | ❌ |
| CVE-2016-6131 | High |
7.5 | binutilsbinutils-2.38 | Direct | ht - 2.1.0+repack1-2,2.1.0+repack1-2,2.1.0+repack1-2,2.1.0+repack1-2;binutils - 2.27.51.20161102-1,2.27.51.20161102-1,2.27.51.20161102-1,2.27.51.20161102-1 | ❌ |
| CVE-2017-7223 | High |
7.5 | binutilsbinutils-2.38 | Direct | 2.29 | ❌ |
| CVE-2017-13710 | High |
7.5 | binutilsbinutils-2.38 | Direct | binutils-2_30 | ❌ |
| CVE-2021-3530 | High |
7.5 | binutilsbinutils-2.38 | Direct | binutils - 2.35,2.36 | ❌ |
| CVE-2017-15938 | High |
7.5 | binutilsbinutils-2.38 | Direct | binutils - 2.29.90.20180122-1,2.29.90.20180122-1,2.29.90.20180122-1 | ❌ |
| CVE-2021-3549 | High |
7.1 | binutilsbinutils-2.38 | Direct | binutils - 2.37-3 | ❌ |
| CVE-2017-12967 | Medium |
6.5 | binutilsbinutils-2.38 | Direct | binutils - 2.29-5,2.29-5,2.29-5 | ❌ |
| CVE-2018-20712 | Medium |
6.5 | binutilsbinutils-2.38 | Direct | binutils - 2.32-1 | ❌ |
| CVE-2021-3487 | Medium |
6.5 | binutilsbinutils-2.38 | Direct | binutils-2_36 | ❌ |
| CVE-2021-20197 | Medium |
6.3 | multiple | Direct | 2_36 | ❌ |
| CVE-2020-35494 | Medium |
6.1 | binutilsbinutils-2.38 | Direct | binutils-2_34 | ❌ |
| CVE-2018-19932 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils - 2.32-1 | ❌ |
| CVE-2021-20284 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.36 | ❌ |
| CVE-2020-35496 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_34 | ❌ |
| CVE-2020-35495 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_34 | ❌ |
| CVE-2017-14940 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2020-16599 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_35 | ❌ |
| CVE-2020-16593 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_35 | ❌ |
| CVE-2020-16590 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_35 | ❌ |
| CVE-2020-16592 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_35 | ❌ |
| CVE-2020-35493 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_34 | ❌ |
| CVE-2020-16591 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_35 | ❌ |
| CVE-2019-14444 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.33 | ❌ |
| CVE-2018-20671 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | gdb-8.1.1-release | ❌ |
| CVE-2018-20673 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | gcc-plugin-devel-debuginfo - 8.5.0-3,8.5.0-3;libquadmath-debuginfo - 8.5.0-3,8.5.0-3;libatomic-static - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc-debuginfo - 8.5.0-3,8.5.0-3;libgomp-offload-nvptx-debuginfo - 8.5.0-3;gcc-debugsource - 8.5.0-3,8.5.0-3;libquadmath-devel - 8.5.0-3,8.5.0-3,8.5.0-3;libquadmath - 8.5.0-3,8.5.0-3,8.5.0-3;libgomp-debuginfo - 8.5.0-3,8.5.0-3;libstdc++-devel - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libstdc++-docs - 8.5.0-3,8.5.0-3,8.5.0-3;cpp-debuginfo - 8.5.0-3,8.5.0-3;libstdc++-debuginfo - 8.5.0-3,8.5.0-3;libatomic - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc-gdb-plugin - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libstdc++ - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc-c++-debuginfo - 8.5.0-3,8.5.0-3;libubsan-debuginfo - 8.5.0-3,8.5.0-3;libubsan - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;liblsan-debuginfo - 8.5.0-3;libatomic-debuginfo - 8.5.0-3,8.5.0-3;libgcc - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libitm - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc-offload-nvptx - 8.5.0-3,8.5.0-3;libgcc-debuginfo - 8.5.0-3,8.5.0-3;gcc-gdb-plugin-debuginfo - 8.5.0-3,8.5.0-3;gcc-gfortran - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libgomp-offload-nvptx - 8.5.0-3,8.5.0-3;gcc-c++ - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libgfortran - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;cpp - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;gcc-gfortran-debuginfo - 8.5.0-3,8.5.0-3;gcc-offload-nvptx-debuginfo - 8.5.0-3;libitm-devel - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libitm-debuginfo - 8.5.0-3,8.5.0-3;libasan-debuginfo - 8.5.0-3,8.5.0-3;libtsan-debuginfo - 8.5.0-3;libasan - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;libgfortran-debuginfo - 8.5.0-3,8.5.0-3;libgomp - 8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3,8.5.0-3;liblsan - 8.5.0-3,8.5.0-3,8.5.0-3;libtsan - 8.5.0-3,8.5.0-3,8.5.0-3 | ❌ |
| CVE-2017-14974 | Medium |
5.5 | multiple | Direct | 2.30 | ❌ |
| CVE-2017-15225 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-15025 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-15024 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-14939 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2018-9138 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils - 2.32.51.20190707-1,2.32.51.20190707-1 | ❌ |
| CVE-2017-14938 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2018-20623 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_32,gdb-8.3-release | ❌ |
| CVE-2017-15023 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_30 | ❌ |
| CVE-2017-15022 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-15021 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-14130 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_30 | ❌ |
| CVE-2020-35507 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-2_34 | ❌ |
| CVE-2017-15939 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | binutils-dev - 2.26.1-1ubuntu1 |
❌ |
| CVE-2017-14529 | Medium |
5.5 | binutilsbinutils-2.38 | Direct | 2.30 | ❌ |
| CVE-2017-13757 | Medium |
5.5 | multiple | Direct | binutils-2_30 | ❌ |
Details
Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2018-6323
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-01-26
URL: CVE-2018-6323
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6323
Release Date: 2018-01-26
Fix Resolution: binutils-2_31
Step up your Open Source Security Game with Mend here
CVE-2021-20294
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.
Publish Date: 2021-04-29
URL: CVE-2021-20294
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1943533
Release Date: 2021-04-29
Fix Resolution: binutils-2_35_2
Step up your Open Source Security Game with Mend here
CVE-2021-45078
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.
Publish Date: 2021-12-15
URL: CVE-2021-45078
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-45078
Release Date: 2021-12-15
Fix Resolution: binutils - 2.37.50.20220106-1
Step up your Open Source Security Game with Mend here
CVE-2017-12456
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.
Publish Date: 2017-08-04
URL: CVE-2017-12456
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12456
Release Date: 2017-08-04
Fix Resolution: binutils-2_30
Step up your Open Source Security Game with Mend here
CVE-2017-12454
Vulnerable Libraries - binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38
Vulnerability Details
The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.
Publish Date: 2017-08-04
URL: CVE-2017-12454
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-12454
Release Date: 2017-08-04
Fix Resolution: binutils - 2.29-9,2.29-9,2.29-9
Step up your Open Source Security Game with Mend here
CVE-2017-12455
Vulnerable Libraries - binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38
Vulnerability Details
The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
Publish Date: 2017-08-04
URL: CVE-2017-12455
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-12455
Release Date: 2017-08-04
Fix Resolution: binutils - 2.29-8,2.29-8,2.29-8
Step up your Open Source Security Game with Mend here
CVE-2017-12453
Vulnerable Libraries - binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38, binutilsbinutils-2.38
Vulnerability Details
The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
Publish Date: 2017-08-04
URL: CVE-2017-12453
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-12453
Release Date: 2017-08-04
Fix Resolution: binutils - 2.29-9,2.29-9,2.29-9
Step up your Open Source Security Game with Mend here
CVE-2019-1010180
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.
Publish Date: 2019-07-24
URL: CVE-2019-1010180
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-1010178
Release Date: 2019-07-24
Fix Resolution: binutils-2_32,gdb-8.3-release
Step up your Open Source Security Game with Mend here
CVE-2017-12450
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.
Publish Date: 2017-08-04
URL: CVE-2017-12450
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12450
Release Date: 2017-08-04
Fix Resolution: 2.30
Step up your Open Source Security Game with Mend here
CVE-2018-19931
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.
Publish Date: 2018-12-07
URL: CVE-2018-19931
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-19931
Release Date: 2018-12-07
Fix Resolution: binutils - 2.32-1
Step up your Open Source Security Game with Mend here
CVE-2017-12458
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.
Publish Date: 2017-08-04
URL: CVE-2017-12458
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12458
Release Date: 2017-08-04
Fix Resolution: binutils-2_29_1
Step up your Open Source Security Game with Mend here
CVE-2017-14745
Vulnerable Libraries - binutilsbinutils-2.38, binutilsbinutils-2.38
Vulnerability Details
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.
Publish Date: 2017-09-26
URL: CVE-2017-14745
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14745
Release Date: 2017-09-26
Fix Resolution: binutils-2_30
Step up your Open Source Security Game with Mend here
CVE-2017-15996
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.
Publish Date: 2017-10-29
URL: CVE-2017-15996
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15996
Release Date: 2017-10-29
Fix Resolution: 2.30
Step up your Open Source Security Game with Mend here
CVE-2018-1000876
Vulnerable Libraries - binutilsbinutils-2.38, binutilsbinutils-2.38
Vulnerability Details
binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.
Publish Date: 2018-12-20
URL: CVE-2018-1000876
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000876
Release Date: 2018-12-20
Fix Resolution: binutils-devel - 2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base;binutils-debuginfo - 2.27-41.base,2.27-41.base;binutils - 2.27-41.base,2.27-41.base,2.27-41.base,2.27-41.base
Step up your Open Source Security Game with Mend here
CVE-2017-12448
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.
Publish Date: 2017-08-04
URL: CVE-2017-12448
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2017-08-04
Fix Resolution: binutils-2_30,gdb-8.1-release,users/ARM/embedded-binutils-2_30-branch-2018q2
Step up your Open Source Security Game with Mend here
CVE-2017-14333
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.
Publish Date: 2017-09-12
URL: CVE-2017-14333
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-14333
Release Date: 2017-09-12
Fix Resolution: binutils - 2.29-9,2.29-9,2.29-9
Step up your Open Source Security Game with Mend here
CVE-2017-17125
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.
Publish Date: 2017-12-04
URL: CVE-2017-17125
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17125
Release Date: 2017-12-04
Fix Resolution: 2.30
Step up your Open Source Security Game with Mend here
CVE-2017-16831
Vulnerable Library - binutilsbinutils-2.38
Gnu Distributions
Library home page: https://ftp.gnu.org/gnu/binutils?wsslib=binutils
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.
Publish Date: 2017-11-15
URL: CVE-2017-16831
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16831
Release Date: 2017-11-15
Fix Resolution: 2.30
Step up your Open Source Security Game with Mend here
zlibv1.2.11: 1 vulnerabilities (highest severity is: 6.5)
Vulnerable Library - zlibv1.2.11
A massively spiffy yet delicately unobtrusive compression library.
Library home page: https://github.com/madler/zlib.git
Vulnerable Source Files (3)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| WS-2020-0368 | Medium |
6.5 | multiple | Direct | cmake-native - 3.15.5;binutils-cross-testsuite - 2.35;libstd-rs - 1.57.0;gdb - 11.1,9.2;tcl - 8.6.11;sudo - 1.8.32;binutils - 2.35,2.28;ccache - 3.3.3,4.1;libgit2 - 1.3.0;cmake - 3.19.5,3.7.0,3.7.2,3.22.0,3.17.3;cmake-native - 3.17.3,3.7.0,3.22.0,3.18.4;ghostscript - 9.55.0 | ❌ |
Details
WS-2020-0368
Vulnerable Libraries - zlibv1.2.11, zlibv1.2.11, zlibv1.2.11
Vulnerability Details
Zlib in versions v0.8 to v1.2.11 is vulnerable to use-of-uninitialized-value in inflate.
There are a couple of places in inflate() where UPDATE is called with state->check as its first parameter, without a guarantee that this value has been initialized (state comes from a ZALLOC in inflateInit). This causes use of uninitialized check value.
Publish Date: 2020-02-22
URL: WS-2020-0368
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2020-0368
Release Date: 2020-02-22
Fix Resolution: cmake-native - 3.15.5;binutils-cross-testsuite - 2.35;libstd-rs - 1.57.0;gdb - 11.1,9.2;tcl - 8.6.11;sudo - 1.8.32;binutils - 2.35,2.28;ccache - 3.3.3,4.1;libgit2 - 1.3.0;cmake - 3.19.5,3.7.0,3.7.2,3.22.0,3.17.3;cmake-native - 3.17.3,3.7.0,3.22.0,3.18.4;ghostscript - 9.55.0
Step up your Open Source Security Game with Mend here
jasperversion-2.0.10: 10 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2008-3522 | High |
9.8 | jasperversion-2.0.10 | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2008-3520 | High |
8.1 | multiple | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2016-9583 | High |
7.8 | jasperversion-2.0.10 | Direct | 2.0.6 | ❌ |
| CVE-2020-27828 | High |
7.8 | jasperversion-2.0.10 | Direct | version-2.0.23 | ❌ |
| CVE-2016-9600 | Medium |
6.5 | jasperversion-2.0.10 | Direct | jasper - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30;jasper-devel - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30;jasper-debuginfo - 1.900.1-30,1.900.1-30,1.900.1-30;jasper-utils - 1.900.1-30,1.900.1-30,1.900.1-30;jasper-libs - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30 | ❌ |
| CVE-2011-4516 | Medium |
5.6 | jasperversion-2.0.10 | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2017-6850 | Medium |
5.5 | jasperversion-2.0.10 | Direct | 2.0.13 | ❌ |
| CVE-2017-5504 | Medium |
5.5 | multiple | Direct | version-2.0.17 | ❌ |
| CVE-2017-5505 | Medium |
5.5 | multiple | Direct | version-2.0.17 | ❌ |
| CVE-2021-27845 | Medium |
5.5 | jasperversion-2.0.10 | Direct | version-2.0.17 | ❌ |
Details
CVE-2008-3522
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.
Publish Date: 2008-10-02
URL: CVE-2008-3522
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-3522
Release Date: 2008-10-02
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2008-3520
Vulnerable Libraries - jasperversion-2.0.10, jasperversion-2.0.10
Vulnerability Details
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
Publish Date: 2008-10-02
URL: CVE-2008-3520
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-3520
Release Date: 2008-10-02
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2016-9583
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
Publish Date: 2018-08-01
URL: CVE-2016-9583
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9583
Release Date: 2018-08-01
Fix Resolution: 2.0.6
Step up your Open Source Security Game with Mend here
CVE-2020-27828
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
Publish Date: 2020-12-11
URL: CVE-2020-27828
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2020-12-11
Fix Resolution: version-2.0.23
Step up your Open Source Security Game with Mend here
CVE-2016-9600
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Publish Date: 2018-03-12
URL: CVE-2016-9600
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9600
Release Date: 2018-03-12
Fix Resolution: jasper - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30;jasper-devel - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30;jasper-debuginfo - 1.900.1-30,1.900.1-30,1.900.1-30;jasper-utils - 1.900.1-30,1.900.1-30,1.900.1-30;jasper-libs - 1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30,1.900.1-30
Step up your Open Source Security Game with Mend here
CVE-2011-4516
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.
Publish Date: 2011-12-15
URL: CVE-2011-4516
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-4516
Release Date: 2011-12-15
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2017-6850
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
Publish Date: 2017-03-15
URL: CVE-2017-6850
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6850
Release Date: 2017-03-15
Fix Resolution: 2.0.13
Step up your Open Source Security Game with Mend here
CVE-2017-5504
Vulnerable Libraries - jasperversion-2.0.10, jasperversion-2.0.10, jasperversion-2.0.10
Vulnerability Details
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-01
URL: CVE-2017-5504
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5504
Release Date: 2017-03-01
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2017-5505
Vulnerable Libraries - jasperversion-2.0.10, jasperversion-2.0.10, jasperversion-2.0.10
Vulnerability Details
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-16
URL: CVE-2017-5505
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5505
Release Date: 2017-03-16
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2021-27845
Vulnerable Library - jasperversion-2.0.10
Our efforts were merged into https://github.com/jasper-software/jasper See issue 208 there
Library home page: https://github.com/jasper-maint/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
Publish Date: 2021-07-15
URL: CVE-2021-27845
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27845
Release Date: 2021-07-15
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
officialnetgearfirmwareRND_5.3.5_WW.src: 1 vulnerabilities (highest severity is: 7.8) - autoclosed
Vulnerable Library - officialnetgearfirmwareRND_5.3.5_WW.src
Library home page: https://sourceforge.net/projects/officialnetgearfirmware/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2016-9583 | High |
7.8 | officialnetgearfirmwareRND_5.3.5_WW.src | Direct | 2.0.6 | ❌ |
Details
CVE-2016-9583
Vulnerable Library - officialnetgearfirmwareRND_5.3.5_WW.src
Library home page: https://sourceforge.net/projects/officialnetgearfirmware/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
Publish Date: 2018-08-01
URL: CVE-2016-9583
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9583
Release Date: 2018-08-01
Fix Resolution: 2.0.6
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 26 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 29 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-2057 | Medium |
5.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-2058 | Medium |
5.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-2056 | Medium |
5.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-2057
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2057
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-2058
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2058
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-2056
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2056
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
salix-sboxbmc-11.0: 26 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Vulnerable Source Files (2)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-12652 | High |
9.8 | multiple | Direct | 1.6.32 | ❌ |
| CVE-2010-1205 | High |
9.8 | salix-sboxbmc-11.0 | Direct | 1.2.44,1.4.3 | ❌ |
| CVE-2011-2692 | High |
8.8 | salix-sboxbmc-11.0 | Direct | 1.0.55,1.2.45,1.4.8,1.5.4 | ❌ |
| CVE-2015-8540 | High |
8.8 | salix-sboxbmc-11.0 | Direct | 1.0.66,1.2.56,1.4.19,1.5.26 | ❌ |
| CVE-2016-10251 | High |
7.8 | salix-sboxbmc-11.0 | Direct | 1.900.20 | ❌ |
| CVE-2016-10087 | High |
7.5 | multiple | Direct | 1.0.67,1.2.57,1.4.20,1.5.28,1.6.27 | ❌ |
| CVE-2017-13747 | High |
7.5 | salix-sboxbmc-11.0 | Direct | jasper | |
| ❌ | ||||||
| CVE-2016-9398 | High |
7.5 | salix-sboxbmc-11.0 | Direct | 1.900.17 | ❌ |
| CVE-2015-8126 | High |
7.3 | salix-sboxbmc-11.0 | Direct | 1.0.64,1.2.54,1.4.17,1.5.24,1.6.19 | ❌ |
| CVE-2015-8472 | High |
7.3 | salix-sboxbmc-11.0 | Direct | 1.0.65,1.2.55,1.4.18,1.5.25,1.6.20 | ❌ |
| CVE-2020-14152 | High |
7.1 | salix-sboxbmc-11.0 | Direct | jpeg-9d | ❌ |
| CVE-2015-5203 | High |
7.0 | salix-sboxbmc-11.0 | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2017-15232 | Medium |
6.5 | salix-sboxbmc-11.0 | Direct | 1.5.3 | ❌ |
| CVE-2011-2691 | Medium |
6.5 | salix-sboxbmc-11.0 | Direct | 1.0.55,1.2.45,1.4.8,1.5.4 | ❌ |
| CVE-2011-2501 | Medium |
6.5 | salix-sboxbmc-11.0 | Direct | 1.0.55,1.2.45,1.4.8,1.5.4 | ❌ |
| CVE-2011-3048 | Medium |
5.6 | salix-sboxbmc-11.0 | Direct | 1.0.59,1.2.49,1.4.11,1.5.10 | ❌ |
| CVE-2011-3045 | Medium |
5.6 | salix-sboxbmc-11.0 | Direct | libpng - 1.4.10beta01,Google Chrome - 17.0.963.83 | ❌ |
| CVE-2012-2806 | Medium |
5.6 | salix-sboxbmc-11.0 | Direct | All libjpeg-turbo users should upgrade to the latest version >= libjpeg-turbo-1.2.1 | |
| ❌ | ||||||
| CVE-2018-9055 | Medium |
5.5 | multiple | Direct | Replace or update the following files: jpc_math.c, jpc_math.h | ❌ |
| CVE-2013-6630 | Medium |
5.3 | salix-sboxbmc-11.0 | Direct | 1.3.1 | ❌ |
| CVE-2008-5907 | Medium |
5.3 | salix-sboxbmc-11.0 | Direct | 1.0.42,1.2.34 | ❌ |
| CVE-2015-7981 | Medium |
5.3 | salix-sboxbmc-11.0 | Direct | 1.0.64,1.2.54,1.4.17 | ❌ |
| CVE-2013-6629 | Medium |
5.3 | salix-sboxbmc-11.0 | Direct | 1.3.90 | ❌ |
| CVE-2008-3964 |  Low |
3.7 | salix-sboxbmc-11.0 | Direct | 1.2.32beta01,1.4.0beta34 | ❌ |
| CVE-2009-5063 | Low |
3.7 | salix-sboxbmc-11.0 | Direct | 1.2.39beta5 | ❌ |
| CVE-2012-3425 | Low |
3.7 | salix-sboxbmc-11.0 | Direct | 1.0.58,1.2.48,1.4.10,1.5.10 | ❌ |
Details
CVE-2017-12652
Vulnerable Libraries - salix-sboxbmc-11.0, salix-sboxbmc-11.0
Vulnerability Details
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
Publish Date: 2019-07-10
URL: CVE-2017-12652
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12652
Release Date: 2019-07-10
Fix Resolution: 1.6.32
Step up your Open Source Security Game with Mend here
CVE-2010-1205
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
Publish Date: 2010-06-30
URL: CVE-2010-1205
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205
Release Date: 2010-06-30
Fix Resolution: 1.2.44,1.4.3
Step up your Open Source Security Game with Mend here
CVE-2011-2692
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.
Publish Date: 2011-07-17
URL: CVE-2011-2692
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-2692
Release Date: 2011-07-17
Fix Resolution: 1.0.55,1.2.45,1.4.8,1.5.4
Step up your Open Source Security Game with Mend here
CVE-2015-8540
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.
Publish Date: 2016-04-14
URL: CVE-2015-8540
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8540
Release Date: 2016-04-14
Fix Resolution: 1.0.66,1.2.56,1.4.19,1.5.26
Step up your Open Source Security Game with Mend here
CVE-2016-10251
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
Publish Date: 2017-03-15
URL: CVE-2016-10251
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10251
Release Date: 2017-03-15
Fix Resolution: 1.900.20
Step up your Open Source Security Game with Mend here
CVE-2016-10087
Vulnerable Libraries - salix-sboxbmc-11.0, salix-sboxbmc-11.0
Vulnerability Details
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
Publish Date: 2017-01-30
URL: CVE-2016-10087
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10087
Release Date: 2017-01-30
Fix Resolution: 1.0.67,1.2.57,1.4.20,1.5.28,1.6.27
Step up your Open Source Security Game with Mend here
CVE-2017-13747
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
Publish Date: 2017-08-29
URL: CVE-2017-13747
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201908-03
Fix Resolution: jasper
Step up your Open Source Security Game with Mend here
CVE-2016-9398
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
Publish Date: 2017-03-23
URL: CVE-2016-9398
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9398
Release Date: 2017-03-23
Fix Resolution: 1.900.17
Step up your Open Source Security Game with Mend here
CVE-2015-8126
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Publish Date: 2015-11-13
URL: CVE-2015-8126
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8126
Release Date: 2015-11-13
Fix Resolution: 1.0.64,1.2.54,1.4.17,1.5.24,1.6.19
Step up your Open Source Security Game with Mend here
CVE-2015-8472
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Publish Date: 2016-01-21
URL: CVE-2015-8472
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8472
Release Date: 2016-01-21
Fix Resolution: 1.0.65,1.2.55,1.4.18,1.5.25,1.6.20
Step up your Open Source Security Game with Mend here
CVE-2020-14152
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
Publish Date: 2020-06-15
URL: CVE-2020-14152
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14152
Release Date: 2020-07-31
Fix Resolution: jpeg-9d
Step up your Open Source Security Game with Mend here
CVE-2015-5203
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Publish Date: 2017-08-02
URL: CVE-2015-5203
CVSS 3 Score Details (7.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-5203
Release Date: 2017-08-02
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2017-15232
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.
Publish Date: 2017-10-11
URL: CVE-2017-15232
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15232
Release Date: 2017-10-11
Fix Resolution: 1.5.3
Step up your Open Source Security Game with Mend here
CVE-2011-2691
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
Publish Date: 2011-07-17
URL: CVE-2011-2691
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-2691
Release Date: 2011-07-17
Fix Resolution: 1.0.55,1.2.45,1.4.8,1.5.4
Step up your Open Source Security Game with Mend here
CVE-2011-2501
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.
Publish Date: 2011-07-17
URL: CVE-2011-2501
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-2501
Release Date: 2011-07-17
Fix Resolution: 1.0.55,1.2.45,1.4.8,1.5.4
Step up your Open Source Security Game with Mend here
CVE-2011-3048
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
Publish Date: 2012-05-29
URL: CVE-2011-3048
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-3048
Release Date: 2012-05-29
Fix Resolution: 1.0.59,1.2.49,1.4.11,1.5.10
Step up your Open Source Security Game with Mend here
CVE-2011-3045
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.
Publish Date: 2012-03-22
URL: CVE-2011-3045
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-3045
Release Date: 2012-03-22
Fix Resolution: libpng - 1.4.10beta01,Google Chrome - 17.0.963.83
Step up your Open Source Security Game with Mend here
CVE-2012-2806
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Heap-based buffer overflow in the get_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large component count in the header of a JPEG image.
Publish Date: 2012-08-13
URL: CVE-2012-2806
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: http://security.gentoo.org/glsa/glsa-201209-13.xml
Release Date: 2012-09-26
Fix Resolution: All libjpeg-turbo users should upgrade to the latest version >= libjpeg-turbo-1.2.1
Step up your Open Source Security Game with Mend here
CVE-2018-9055
Vulnerable Libraries - salix-sboxbmc-11.0, salix-sboxbmc-11.0
Vulnerability Details
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
Publish Date: 2018-03-27
URL: CVE-2018-9055
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Change files
Release Date: 2019-03-25
Fix Resolution: Replace or update the following files: jpc_math.c, jpc_math.h
Step up your Open Source Security Game with Mend here
CVE-2013-6630
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Publish Date: 2013-11-19
URL: CVE-2013-6630
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2013-11-19
Fix Resolution: 1.3.1
Step up your Open Source Security Game with Mend here
CVE-2008-5907
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the '\0' character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.
Publish Date: 2009-01-15
URL: CVE-2008-5907
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-5907
Release Date: 2009-01-15
Fix Resolution: 1.0.42,1.2.34
Step up your Open Source Security Game with Mend here
CVE-2015-7981
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
Publish Date: 2015-11-24
URL: CVE-2015-7981
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-7981
Release Date: 2015-11-24
Fix Resolution: 1.0.64,1.2.54,1.4.17
Step up your Open Source Security Game with Mend here
CVE-2013-6629
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Publish Date: 2013-11-19
URL: CVE-2013-6629
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629
Release Date: 2013-11-19
Fix Resolution: 1.3.90
Step up your Open Source Security Game with Mend here
CVE-2008-3964
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
Publish Date: 2008-09-11
URL: CVE-2008-3964
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-3964
Release Date: 2008-09-11
Fix Resolution: 1.2.32beta01,1.4.0beta34
Step up your Open Source Security Game with Mend here
CVE-2009-5063
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.
Publish Date: 2011-08-31
URL: CVE-2009-5063
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2009-5063
Release Date: 2011-08-31
Fix Resolution: 1.2.39beta5
Step up your Open Source Security Game with Mend here
CVE-2012-3425
Vulnerable Library - salix-sboxbmc-11.0
Source downloads for slackbuild scripts
Library home page: https://sourceforge.net/projects/salix-sbo/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.
Publish Date: 2012-08-13
URL: CVE-2012-3425
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-3425
Release Date: 2012-08-13
Fix Resolution: 1.0.58,1.2.48,1.4.10,1.5.10
Step up your Open Source Security Game with Mend here
jasperversion-1.900.17: 19 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2008-3522 | High |
9.8 | jasperversion-1.900.17 | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2015-8751 | High |
8.8 | jasperversion-1.900.17 | Direct | N/A | ❌ |
| CVE-2008-3520 | High |
8.1 | multiple | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2018-19543 | High |
7.8 | jasperversion-1.900.17 | Direct | N/A | ❌ |
| CVE-2016-9583 | High |
7.8 | multiple | Direct | 2.0.6 | ❌ |
| CVE-2016-8654 | High |
7.8 | jasperversion-1.900.17 | Direct | 2.0.0 | ❌ |
| CVE-2020-27828 | High |
7.8 | jasperversion-1.900.17 | Direct | version-2.0.23 | ❌ |
| CVE-2017-13748 | High |
7.5 | jasperversion-1.900.17 | Direct | jasper | |
| ❌ | ||||||
| CVE-2021-26926 | High |
7.1 | jasperversion-1.900.17 | Direct | version-2.0.25 | ❌ |
| CVE-2011-4516 | Medium |
5.6 | jasperversion-1.900.17 | Direct | jasper - 1.900.2-1 | ❌ |
| CVE-2021-26927 | Medium |
5.5 | jasperversion-1.900.17 | Direct | version-2.0.25 | ❌ |
| CVE-2017-5504 | Medium |
5.5 | multiple | Direct | version-2.0.17 | ❌ |
| CVE-2017-5505 | Medium |
5.5 | multiple | Direct | version-2.0.17 | ❌ |
| CVE-2017-5503 | Medium |
5.5 | jasperversion-1.900.17 | Direct | jasper - 2.0.14-1 | ❌ |
| CVE-2021-3272 | Medium |
5.5 | jasperversion-1.900.17 | Direct | jasper-utils-debuginfo - 2.0.14-5,2.0.14-5;jasper - 2.0.14-5;jasper-debuginfo - 2.0.14-5;jasper-debugsource - 2.0.14-5,2.0.14-5;jasper-libs - 2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5;jasper-libs-debuginfo - 2.0.14-5,2.0.14-5 | ❌ |
| CVE-2017-6850 | Medium |
5.5 | multiple | Direct | 2.0.13 | ❌ |
| CVE-2021-3467 | Medium |
5.5 | jasperversion-1.900.17 | Direct | 2.0.26 | ❌ |
| CVE-2021-3443 | Medium |
5.5 | jasperversion-1.900.17 | Direct | 2.0.27 | ❌ |
| CVE-2021-27845 | Medium |
5.5 | jasperversion-1.900.17 | Direct | version-2.0.17 | ❌ |
Details
CVE-2008-3522
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.
Publish Date: 2008-10-02
URL: CVE-2008-3522
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-3522
Release Date: 2008-10-02
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2015-8751
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
Publish Date: 2020-02-17
URL: CVE-2015-8751
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2008-3520
Vulnerable Libraries - jasperversion-1.900.17, jasperversion-1.900.17
Vulnerability Details
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
Publish Date: 2008-10-02
URL: CVE-2008-3520
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-3520
Release Date: 2008-10-02
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2018-19543
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.
Publish Date: 2018-11-26
URL: CVE-2018-19543
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2016-9583
Vulnerable Libraries - jasperversion-1.900.17, jasperversion-1.900.17
Vulnerability Details
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
Publish Date: 2018-08-01
URL: CVE-2016-9583
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9583
Release Date: 2018-08-01
Fix Resolution: 2.0.6
Step up your Open Source Security Game with Mend here
CVE-2016-8654
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
Publish Date: 2018-08-01
URL: CVE-2016-8654
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8654
Release Date: 2018-08-01
Fix Resolution: 2.0.0
Step up your Open Source Security Game with Mend here
CVE-2020-27828
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
Publish Date: 2020-12-11
URL: CVE-2020-27828
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2020-12-11
Fix Resolution: version-2.0.23
Step up your Open Source Security Game with Mend here
CVE-2017-13748
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.
Publish Date: 2017-08-29
URL: CVE-2017-13748
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201908-03
Fix Resolution: jasper
Step up your Open Source Security Game with Mend here
CVE-2021-26926
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash.
Publish Date: 2021-02-23
URL: CVE-2021-26926
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26926
Release Date: 2021-02-23
Fix Resolution: version-2.0.25
Step up your Open Source Security Game with Mend here
CVE-2011-4516
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.
Publish Date: 2011-12-15
URL: CVE-2011-4516
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-4516
Release Date: 2011-12-15
Fix Resolution: jasper - 1.900.2-1
Step up your Open Source Security Game with Mend here
CVE-2021-26927
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.
Publish Date: 2021-02-23
URL: CVE-2021-26927
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26927
Release Date: 2021-02-23
Fix Resolution: version-2.0.25
Step up your Open Source Security Game with Mend here
CVE-2017-5504
Vulnerable Libraries - jasperversion-1.900.17, jasperversion-1.900.17, jasperversion-1.900.17, jasperversion-1.900.17
Vulnerability Details
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-01
URL: CVE-2017-5504
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5504
Release Date: 2017-03-01
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2017-5505
Vulnerable Libraries - jasperversion-1.900.17, jasperversion-1.900.17, jasperversion-1.900.17, jasperversion-1.900.17
Vulnerability Details
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Publish Date: 2017-03-16
URL: CVE-2017-5505
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5505
Release Date: 2017-03-16
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
CVE-2017-5503
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.
Publish Date: 2017-03-01
URL: CVE-2017-5503
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-5503
Release Date: 2017-03-01
Fix Resolution: jasper - 2.0.14-1
Step up your Open Source Security Game with Mend here
CVE-2021-3272
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
Publish Date: 2021-01-27
URL: CVE-2021-3272
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3272
Release Date: 2021-01-27
Fix Resolution: jasper-utils-debuginfo - 2.0.14-5,2.0.14-5;jasper - 2.0.14-5;jasper-debuginfo - 2.0.14-5;jasper-debugsource - 2.0.14-5,2.0.14-5;jasper-libs - 2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5,2.0.14-5;jasper-libs-debuginfo - 2.0.14-5,2.0.14-5
Step up your Open Source Security Game with Mend here
CVE-2017-6850
Vulnerable Libraries - jasperversion-1.900.17, jasperversion-1.900.17
Vulnerability Details
The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
Publish Date: 2017-03-15
URL: CVE-2017-6850
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6850
Release Date: 2017-03-15
Fix Resolution: 2.0.13
Step up your Open Source Security Game with Mend here
CVE-2021-3467
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Publish Date: 2021-03-25
URL: CVE-2021-3467
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3467
Release Date: 2021-03-25
Fix Resolution: 2.0.26
Step up your Open Source Security Game with Mend here
CVE-2021-3443
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Publish Date: 2021-03-25
URL: CVE-2021-3443
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-03-16
Fix Resolution: 2.0.27
Step up your Open Source Security Game with Mend here
CVE-2021-27845
Vulnerable Library - jasperversion-1.900.17
Official Repository for the JasPer Image Coding Toolkit
Library home page: https://github.com/hunter-packages/jasper.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
Publish Date: 2021-07-15
URL: CVE-2021-27845
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27845
Release Date: 2021-07-15
Fix Resolution: version-2.0.17
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 30 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-2057 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-2058 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-2056 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-34266 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.4.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
Partial details (29 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2022-2057
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2057
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-2058
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2058
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-2056
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2056
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-34266
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
Publish Date: 2022-07-19
URL: CVE-2022-34266
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html
Release Date: 2022-07-19
Fix Resolution: v4.4.0
Step up your Open Source Security Game with Mend here
bootstrap-3.3.7.min.js: 6 vulnerabilities (highest severity is: 6.1)
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2019-8331 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1 | ❌ |
| CVE-2018-14040 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0 | ❌ |
| CVE-2018-20677 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0 | ❌ |
| CVE-2018-14042 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0 | ❌ |
| CVE-2018-20676 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | bootstrap - 3.4.0 | ❌ |
| CVE-2016-10735 | Medium |
6.1 | bootstrap-3.3.7.min.js | Direct | bootstrap - 3.4.0, 4.0.0-beta.2 | ❌ |
Details
CVE-2019-8331
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Publish Date: 2019-02-20
URL: CVE-2019-8331
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2019-02-20
Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1
Step up your Open Source Security Game with Mend here
CVE-2018-14040
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
Publish Date: 2018-07-13
URL: CVE-2018-14040
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0
Step up your Open Source Security Game with Mend here
CVE-2018-20677
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Publish Date: 2019-01-09
URL: CVE-2018-20677
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677
Release Date: 2019-01-09
Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0
Step up your Open Source Security Game with Mend here
CVE-2018-14042
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
Publish Date: 2018-07-13
URL: CVE-2018-14042
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0
Step up your Open Source Security Game with Mend here
CVE-2018-20676
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Publish Date: 2019-01-09
URL: CVE-2018-20676
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676
Release Date: 2019-01-09
Fix Resolution: bootstrap - 3.4.0
Step up your Open Source Security Game with Mend here
CVE-2016-10735
Vulnerable Library - bootstrap-3.3.7.min.js
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Path to vulnerable library: /ImageMagick-7.0.5-4/www/js/magick.js
Dependency Hierarchy:
- ❌ bootstrap-3.3.7.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
Publish Date: 2019-01-09
URL: CVE-2016-10735
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735
Release Date: 2019-01-09
Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 26 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
dsgplds.northstarplus-1.2.env: 9 vulnerabilities (highest severity is: 8.8)
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2021-3246 | High |
8.8 | dsgplds.northstarplus-1.2.env | Direct | 1.1.0 | ❌ |
| CVE-2021-4156 | High |
8.1 | dsgplds.northstarplus-1.2.env | Direct | 1.1.0beta1 | ❌ |
| CVE-2017-14245 | High |
8.1 | dsgplds.northstarplus-1.2.env | Direct | no_fix | ❌ |
| CVE-2015-7805 | High |
8.1 | dsgplds.northstarplus-1.2.env | Direct | 1.0.26 | ❌ |
| CVE-2018-19758 | Medium |
6.5 | dsgplds.northstarplus-1.2.env | Direct | no_fix | ❌ |
| CVE-2017-7742 | Medium |
5.5 | dsgplds.northstarplus-1.2.env | Direct | 1.0.28 | ❌ |
| CVE-2014-9756 | Medium |
5.3 | dsgplds.northstarplus-1.2.env | Direct | 1.0.26 | ❌ |
| CVE-2019-3832 | Medium |
5.0 | dsgplds.northstarplus-1.2.env | Direct | NO_FIX_VERSION | ❌ |
| CVE-2014-9496 | Medium |
4.0 | dsgplds.northstarplus-1.2.env | Direct | 1.0.26 | ❌ |
Details
CVE-2021-3246
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.
Publish Date: 2021-07-20
URL: CVE-2021-3246
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-07-20
Fix Resolution: 1.1.0
Step up your Open Source Security Game with Mend here
CVE-2021-4156
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
Publish Date: 2022-03-23
URL: CVE-2021-4156
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-03-23
Fix Resolution: 1.1.0beta1
Step up your Open Source Security Game with Mend here
CVE-2017-14245
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.
Publish Date: 2017-09-21
URL: CVE-2017-14245
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-14245
Release Date: 2017-09-21
Fix Resolution: no_fix
Step up your Open Source Security Game with Mend here
CVE-2015-7805
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.
Publish Date: 2015-11-17
URL: CVE-2015-7805
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7805
Release Date: 2015-11-17
Fix Resolution: 1.0.26
Step up your Open Source Security Game with Mend here
CVE-2018-19758
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of service.
Publish Date: 2018-11-30
URL: CVE-2018-19758
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-19758
Release Date: 2018-11-30
Fix Resolution: no_fix
Step up your Open Source Security Game with Mend here
CVE-2017-7742
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
Publish Date: 2017-04-12
URL: CVE-2017-7742
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201707-04
Release Date: 2017-04-12
Fix Resolution: 1.0.28
Step up your Open Source Security Game with Mend here
CVE-2014-9756
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Publish Date: 2015-11-19
URL: CVE-2014-9756
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://usn.ubuntu.com/2832-1/
Release Date: 2015-11-19
Fix Resolution: 1.0.26
Step up your Open Source Security Game with Mend here
CVE-2019-3832
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash.
Publish Date: 2019-03-21
URL: CVE-2019-3832
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3832
Release Date: 2020-10-29
Fix Resolution: NO_FIX_VERSION
Step up your Open Source Security Game with Mend here
CVE-2014-9496
Vulnerable Library - dsgplds.northstarplus-1.2.env
The open source projects that ship with Synology NAS.
Library home page: https://sourceforge.net/projects/dsgpl/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
Publish Date: 2015-01-16
URL: CVE-2014-9496
CVSS 3 Score Details (4.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201612-03
Release Date: 2015-01-16
Fix Resolution: 1.0.26
Step up your Open Source Security Game with Mend here
ImageMagick7.0.5-4: 164 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-14624 | High |
9.8 | ImageMagick7.0.5-4 | Direct | 7.0.7-0 | ❌ |
| CVE-2017-13139 | High |
9.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2018-16329 | High |
9.8 | multiple | Direct | 7.0.8-8 | ❌ |
| CVE-2018-16328 | High |
9.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-8,7.0.8-8 | ❌ |
| CVE-2019-13298 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-50 | ❌ |
| CVE-2019-13297 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13295 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13299 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-50 | ❌ |
| CVE-2017-13146 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.5-6 | ❌ |
| CVE-2019-17540 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-57 | ❌ |
| CVE-2019-17547 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-62 | ❌ |
| CVE-2019-17541 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-55 | ❌ |
| CVE-2019-9956 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-35 | ❌ |
| CVE-2017-12665 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-12666 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-12663 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-12664 | High |
8.8 | multiple | Direct | 7.0.6-2 | ❌ |
| CVE-2017-12662 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-15015 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.7-0 | ❌ |
| CVE-2017-12669 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-12667 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12668 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2019-13135 | High |
8.8 | ImageMagick7.0.5-4 | Direct | v7.0.8-50, v6.9.10-50 | ❌ |
| CVE-2017-11170 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.5-6 | ❌ |
| CVE-2019-13302 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13300 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13306 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13305 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13304 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13303 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13308 | High |
8.8 | multiple | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13307 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2017-12644 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12641 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12642 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12640 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2019-13391 | High |
8.8 | multiple | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-15140 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.8-43 | ❌ |
| CVE-2017-12587 | High |
8.8 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2019-10650 | High |
8.1 | ImageMagick7.0.5-4 | Direct | 7.0.8-36 | ❌ |
| CVE-2020-27766 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2022-28463 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 7.1.0-29 | ❌ |
| CVE-2022-32546 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 7.1.0-29 | ❌ |
| CVE-2022-32547 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 7.1.0-30 | ❌ |
| CVE-2019-13136 | High |
7.8 | ImageMagick7.0.5-4 | Direct | v7.0.8-50 | ❌ |
| CVE-2020-19667 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 7.0.10-7 | ❌ |
| CVE-2020-29599 | High |
7.8 | ImageMagick7.0.5-4 | Direct | 6.9.11-40,7.0.10-40 | ❌ |
| CVE-2017-13143 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 6.9.7-6,7.0.4-6 | ❌ |
| CVE-2017-12435 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12430 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12429 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12428 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2019-7395 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-25 | ❌ |
| CVE-2019-7396 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-25 | ❌ |
| CVE-2019-7397 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-25 | ❌ |
| CVE-2019-7398 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-25 | ❌ |
| CVE-2017-12805 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2017-12806 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2021-20313 | High |
7.5 | multiple | Direct | 7.0.11-2 | ❌ |
| CVE-2021-20312 | High |
7.5 | multiple | Direct | 7.0.11-2 | ❌ |
| CVE-2021-20311 | High |
7.5 | multiple | Direct | 7.0.11-2 | ❌ |
| CVE-2021-20310 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.11-2 | ❌ |
| CVE-2019-7175 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-25 | ❌ |
| CVE-2021-3610 | High |
7.5 | ImageMagick7.0.5-4 | Direct | 7.0.11-14 | ❌ |
| CVE-2019-10131 | High |
7.1 | ImageMagick7.0.5-4 | Direct | 7.0.7-28 | ❌ |
| CVE-2019-13296 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-13454 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | ImageMagick-devel - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick-debuginfo - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;emacs-common - 24.3-23,24.3-23,24.3-23;emacs-filesystem - 24.3-23;emacs-nox - 24.3-23,24.3-23,24.3-23;autotrace-debuginfo - 0.31.1-38,0.31.1-38;autotrace - 0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38;ImageMagick-c++-devel - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;inkscape-docs - 0.92.2-3,0.92.2-3,0.92.2-3;inkscape-view - 0.92.2-3,0.92.2-3,0.92.2-3;ImageMagick-perl - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;emacs-debuginfo - 24.3-23,24.3-23;emacs - 24.3-23,24.3-23,24.3-23,24.3-23;emacs-el - 24.3-23;ImageMagick-c++ - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick-doc - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;inkscape - 0.92.2-3,0.92.2-3,0.92.2-3,0.92.2-3;autotrace-devel - 0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38;emacs-terminal - 24.3-23;inkscape-debuginfo - 0.92.2-3 | ❌ |
| CVE-2017-13145 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.5-8 | ❌ |
| CVE-2017-12692 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2017-12693 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2018-6405 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-23 | ❌ |
| CVE-2018-18025 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-13,7.0.8-13 | ❌ |
| CVE-2018-18024 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-13,7.0.8-13 | ❌ |
| CVE-2017-18273 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-16 | ❌ |
| CVE-2018-18023 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-13,7.0.8-13 | ❌ |
| CVE-2017-13141 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-3 | ❌ |
| CVE-2017-12691 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2017-13142 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-13140 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-2 | ❌ |
| CVE-2017-18271 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-16 | ❌ |
| CVE-2017-14741 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-4 | ❌ |
| CVE-2017-14505 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-0 | ❌ |
| CVE-2017-13658 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.9-3 | ❌ |
| CVE-2017-14060 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-0 | ❌ |
| CVE-2017-12434 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12432 | Medium |
6.5 | multiple | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12433 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12431 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-12670 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-3 | ❌ |
| CVE-2018-16323 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-9,7.0.8-9 | ❌ |
| CVE-2017-17680 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-17681 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-17682 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2019-18853 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-69 | ❌ |
| CVE-2017-14173 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2017-14172 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-0 | ❌ |
| CVE-2017-1000476 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-14684 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-4 | ❌ |
| CVE-2017-12427 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-5 | ❌ |
| CVE-2015-8896 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.5-0 | ❌ |
| CVE-2019-14981 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-41,7.0.8-41 | ❌ |
| CVE-2019-14980 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-42,7.0.8-42 | ❌ |
| CVE-2019-11472 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | ImageMagick-devel - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick-debuginfo - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;emacs-common - 24.3-23,24.3-23,24.3-23;emacs-filesystem - 24.3-23;emacs-nox - 24.3-23,24.3-23,24.3-23;autotrace-debuginfo - 0.31.1-38,0.31.1-38;autotrace - 0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38;ImageMagick-c++-devel - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;inkscape-docs - 0.92.2-3,0.92.2-3,0.92.2-3;inkscape-view - 0.92.2-3,0.92.2-3,0.92.2-3;ImageMagick-perl - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;emacs-debuginfo - 24.3-23,24.3-23;emacs - 24.3-23,24.3-23,24.3-23,24.3-23;emacs-el - 24.3-23;ImageMagick-c++ - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;ImageMagick-doc - 6.9.10.68-3,6.9.10.68-3,6.9.10.68-3;inkscape - 0.92.2-3,0.92.2-3,0.92.2-3,0.92.2-3;autotrace-devel - 0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38,0.31.1-38;emacs-terminal - 24.3-23;inkscape-debuginfo - 0.92.2-3 | ❌ |
| CVE-2019-13137 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | v7.0.8-50 | ❌ |
| CVE-2017-12140 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2017-11166 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.5-6 | ❌ |
| CVE-2018-13153 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-5,7.0.8-5 | ❌ |
| CVE-2018-11251 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-23 | ❌ |
| CVE-2019-13301 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-50,7.0.8-50 | ❌ |
| CVE-2019-10714 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-33 | ❌ |
| CVE-2017-12643 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-1 | ❌ |
| CVE-2019-15139 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-41 | ❌ |
| CVE-2017-12875 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.6-6 | ❌ |
| CVE-2017-17885 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-17886 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2019-15141 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-43 | ❌ |
| CVE-2018-16641 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-7 | ❌ |
| CVE-2018-20467 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 6.9.10-16,7.0.8-16 | ❌ |
| CVE-2017-17881 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-17882 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | 7.0.7-12 | ❌ |
| CVE-2017-17883 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | imagemagick - 8:6.9.9.34+dfsg-3,8:6.9.9.34+dfsg-3,8:6.9.9.34+dfsg-3 | ❌ |
| CVE-2017-14528 | Medium |
6.5 | ImageMagick7.0.5-4 | Direct | imagemagick - 8:6.9.10.2+dfsg-2,8:6.9.10.2+dfsg-2,8:6.9.7.4+dfsg-11+deb9u11,8:6.9.10.2+dfsg-2 | ❌ |
| CVE-2020-25664 | Medium |
6.1 | ImageMagick7.0.5-4 | Direct | ImageMagick:7.0.8-68;ImageMagick6:6.9.10-68 | ❌ |
| CVE-2022-0284 | Medium |
6.1 | ImageMagick7.0.5-4 | Direct | 7.1.0-20 | ❌ |
| CVE-2020-27753 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27750 | Medium |
5.5 | multiple | Direct | 7.0.8-68 | ❌ |
| CVE-2021-20246 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.10.62-1 | ❌ |
| CVE-2021-20245 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 6.9.11-62,7.0.10-62 | ❌ |
| CVE-2021-20243 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.10-62 | ❌ |
| CVE-2021-20241 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.10-62;6.9.11-62 | ❌ |
| CVE-2020-27762 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27760 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27770 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2019-13133 | Medium |
5.5 | multiple | Direct | v7.0.8-50 | ❌ |
| CVE-2021-20176 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.10-62 | ❌ |
| CVE-2019-13134 | Medium |
5.5 | multiple | Direct | v7.0.8-50 | ❌ |
| CVE-2020-27829 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.10-46;6.9.11-46 | ❌ |
| CVE-2020-25663 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-25667 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | ImageMagick:7.0.9-0;ImageMagick6:6.9.10-69 | ❌ |
| CVE-2020-25665 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | ImageMagick:7.0.8-68;ImageMagick6:6.9.10-68 | ❌ |
| CVE-2020-25674 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | ImageMagick6: 6.9.10-68; ImageMagick: 7.0.8-68 | ❌ |
| CVE-2020-25676 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | ImageMagick6: 6.9.10-69; ImageMagick: 7.0.9-0 | ❌ |
| CVE-2017-7275 | Medium |
5.5 | ImageMagick7.0.5-4 | Direct | N/A | ❌ |
| CVE-2021-39212 | Medium |
4.4 | multiple | Direct | N/A | ❌ |
| CVE-2020-27755 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27757 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27758 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27754 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | ImageMagick6-6.9.10-69;ImageMagick-7.0.9-0 | ❌ |
| CVE-2020-27767 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27768 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27769 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27763 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27765 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27761 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27759 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.8-68 | ❌ |
| CVE-2020-27773 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27774 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27775 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27776 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27771 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-27772 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | 7.0.9-0 | ❌ |
| CVE-2020-25666 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | ImageMagick:7.0.9-0;ImageMagick6:6.9.10-69 | ❌ |
| CVE-2020-27560 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | imagemagick - 8:6.9.11.57+dfsg-1,8:6.9.7.4+dfsg-11+deb9u11,8:6.9.11.57+dfsg-1 | ❌ |
| CVE-2020-25675 | Low |
3.3 | ImageMagick7.0.5-4 | Direct | ImageMagick6: 6.9.10-69; ImageMagick: 7.0.9-0 | ❌ |
Details
Partial details (11 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2017-14624
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.
Publish Date: 2017-09-21
URL: CVE-2017-14624
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14624
Release Date: 2017-09-21
Fix Resolution: 7.0.7-0
Step up your Open Source Security Game with Mend here
CVE-2017-13139
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
Publish Date: 2017-08-23
URL: CVE-2017-13139
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13139
Release Date: 2017-08-23
Fix Resolution: 7.0.6-1
Step up your Open Source Security Game with Mend here
CVE-2018-16329
Vulnerable Libraries - ImageMagick7.0.5-4, ImageMagick7.0.5-4
Vulnerability Details
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.
Publish Date: 2018-09-01
URL: CVE-2018-16329
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-16329
Release Date: 2018-09-01
Fix Resolution: 7.0.8-8
Step up your Open Source Security Game with Mend here
CVE-2018-16328
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.
Publish Date: 2018-09-01
URL: CVE-2018-16328
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16328
Release Date: 2018-09-01
Fix Resolution: 6.9.10-8,7.0.8-8
Step up your Open Source Security Game with Mend here
CVE-2019-13298
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
Publish Date: 2019-07-05
URL: CVE-2019-13298
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2019-07-05
Fix Resolution: 7.0.8-50
Step up your Open Source Security Game with Mend here
CVE-2019-13297
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
Publish Date: 2019-07-05
URL: CVE-2019-13297
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13297
Release Date: 2020-08-19
Fix Resolution: 6.9.10-50,7.0.8-50
Step up your Open Source Security Game with Mend here
CVE-2019-13295
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
Publish Date: 2019-07-05
URL: CVE-2019-13295
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13295
Release Date: 2020-08-19
Fix Resolution: 6.9.10-50,7.0.8-50
Step up your Open Source Security Game with Mend here
CVE-2019-13299
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
Publish Date: 2019-07-05
URL: CVE-2019-13299
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2019-07-05
Fix Resolution: 7.0.8-50
Step up your Open Source Security Game with Mend here
CVE-2017-13146
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
Publish Date: 2017-08-23
URL: CVE-2017-13146
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870013
Release Date: 2017-08-23
Fix Resolution: 7.0.5-6
Step up your Open Source Security Game with Mend here
CVE-2019-17540
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
Publish Date: 2019-10-14
URL: CVE-2019-17540
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17540
Release Date: 2019-10-14
Fix Resolution: 7.0.8-57
Step up your Open Source Security Game with Mend here
CVE-2019-17547
Vulnerable Library - ImageMagick7.0.5-4
ImageMagick 7
Library home page: https://github.com/ImageMagick/ImageMagick.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
Publish Date: 2019-10-14
URL: CVE-2019-17547
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17547
Release Date: 2019-10-14
Fix Resolution: 7.0.8-62
Step up your Open Source Security Game with Mend here
poppler-cairo-backendpoppler-0.24.2: 35 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2019-9631 | High |
9.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.75.0 | ❌ |
| CVE-2018-21009 | High |
8.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.76.0 | ❌ |
| CVE-2017-15565 | High |
8.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.61 | ❌ |
| CVE-2019-12293 | High |
8.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | evince - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9;poppler-qt - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-cpp-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;evince-browser-plugin - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-glib-debuginfo - 0.66.0-11,0.66.0-11;poppler - 0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.66.0-11,0.66.0-11,0.66.0-11,0.66.0-11;evince-dvi - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-glib-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-debugsource - 0.66.0-11,0.66.0-11;poppler-demos - 0.26.5-42,0.26.5-42,0.26.5-42;poppler-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-debuginfo - 0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.26.5-42;poppler-glib - 0.66.0-11,0.26.5-42,0.26.5-42,0.66.0-11,0.26.5-42,0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.66.0-11;evince-nautilus - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-qt-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-utils-debuginfo - 0.66.0-11,0.66.0-11;poppler-cpp-debuginfo - 0.66.0-11,0.66.0-11;poppler-utils - 0.66.0-11,0.26.5-42,0.66.0-11,0.26.5-42,0.66.0-11,0.26.5-42,0.66.0-11;evince-debuginfo - 3.28.2-9,3.28.2-9;poppler-qt5-debuginfo - 0.66.0-11,0.66.0-11;evince-libs - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9;poppler-cpp - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;evince-devel - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9 | ❌ |
| CVE-2017-2820 | High |
8.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | N/A | ❌ |
| CVE-2015-8868 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.40.0 | ❌ |
| CVE-2017-14518 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.60 | ❌ |
| CVE-2017-14617 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.60 | ❌ |
| CVE-2020-35702 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | N/A | ❌ |
| CVE-2017-14520 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.60 | ❌ |
| CVE-2017-9776 | High |
7.8 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.56 | ❌ |
| CVE-2020-27778 | High |
7.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.76.0 | ❌ |
| CVE-2019-14494 | High |
7.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.79.0 | ❌ |
| CVE-2018-19060 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.72.0 | ❌ |
| CVE-2017-9408 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.55 | ❌ |
| CVE-2017-9406 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.55 | ❌ |
| WS-2019-0558 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.83.0 | |
| ❌ | ||||||
| CVE-2018-10768 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.37 | ❌ |
| WS-2020-0332 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.85.0 | ❌ |
| CVE-2018-16646 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-cpp-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-debuginfo - 4.10.5-7,4.10.5-7;evince-browser-plugin - 3.28.2-8,3.28.2-8,3.28.2-8;poppler - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-dvi - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-glib-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-demos - 0.26.5-38,0.26.5-38,0.26.5-38;poppler-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-libs - 4.10.5-7,4.10.5-7,4.10.5-7;okular-part - 4.10.5-7,4.10.5-7;poppler-debuginfo - 0.26.5-38,0.26.5-38,0.26.5-38;poppler-glib - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-nautilus - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-utils - 0.26.5-38,0.26.5-38,0.26.5-38;evince-debuginfo - 3.28.2-8,3.28.2-8;okular - 4.10.5-7,4.10.5-7,4.10.5-7;evince-libs - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-cpp - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-devel - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;evince - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-devel - 4.10.5-7,4.10.5-7,4.10.5-7 | ❌ |
| CVE-2017-9083 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | N/A | ❌ |
| CVE-2018-19059 | Medium |
6.5 | multiple | Direct | poppler-0.72.0 | ❌ |
| CVE-2018-19058 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-cpp-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-debuginfo - 4.10.5-7,4.10.5-7;evince-browser-plugin - 3.28.2-8,3.28.2-8,3.28.2-8;poppler - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-dvi - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-glib-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-demos - 0.26.5-38,0.26.5-38,0.26.5-38;poppler-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-libs - 4.10.5-7,4.10.5-7,4.10.5-7;okular-part - 4.10.5-7,4.10.5-7;poppler-debuginfo - 0.26.5-38,0.26.5-38,0.26.5-38;poppler-glib - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-nautilus - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-utils - 0.26.5-38,0.26.5-38,0.26.5-38;evince-debuginfo - 3.28.2-8,3.28.2-8;okular - 4.10.5-7,4.10.5-7,4.10.5-7;evince-libs - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-cpp - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-devel - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;evince - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-devel - 4.10.5-7,4.10.5-7,4.10.5-7 | ❌ |
| CVE-2018-20481 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-cpp-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-debuginfo - 4.10.5-7,4.10.5-7;evince-browser-plugin - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-glib-debuginfo - 0.66.0-11,0.66.0-11;poppler - 0.66.0-11,0.66.0-11,0.26.5-38,0.26.5-38,0.26.5-38,0.66.0-11,0.66.0-11,0.26.5-38,0.26.5-38,0.66.0-11,0.26.5-38,0.66.0-11;evince-dvi - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-glib-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-debugsource - 0.66.0-11,0.66.0-11;poppler-demos - 0.26.5-38,0.26.5-38;poppler-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-libs - 4.10.5-7,4.10.5-7,4.10.5-7;okular-part - 4.10.5-7,4.10.5-7;poppler-debuginfo - 0.66.0-11,0.26.5-38,0.66.0-11,0.26.5-38,0.26.5-38;poppler-glib - 0.66.0-11,0.26.5-38,0.66.0-11,0.26.5-38,0.26.5-38,0.66.0-11,0.66.0-11,0.26.5-38,0.26.5-38,0.66.0-11;evince-nautilus - 3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt-devel - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;poppler-utils-debuginfo - 0.66.0-11,0.66.0-11;poppler-cpp-debuginfo - 0.66.0-11,0.66.0-11;poppler-utils - 0.66.0-11,0.26.5-38,0.66.0-11,0.26.5-38,0.26.5-38,0.66.0-11,0.66.0-11;evince-debuginfo - 3.28.2-8,3.28.2-8;poppler-qt5-debuginfo - 0.66.0-11,0.66.0-11;okular - 4.10.5-7,4.10.5-7,4.10.5-7;evince-libs - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-cpp - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;evince-devel - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;evince - 3.28.2-8,3.28.2-8,3.28.2-8,3.28.2-8;poppler-qt - 0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38,0.26.5-38;okular-devel - 4.10.5-7,4.10.5-7,4.10.5-7 | ❌ |
| CVE-2019-9959 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.79.0 | ❌ |
| CVE-2017-9775 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.56 | ❌ |
| CVE-2018-13988 | Medium |
6.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.63.0 | ❌ |
| WS-2018-0645 | Medium |
6.1 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.67.0 | ❌ |
| CVE-2013-1790 | Medium |
5.6 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.22.1 | ❌ |
| CVE-2017-18267 | Medium |
5.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.65.0 | ❌ |
| CVE-2017-14517 | Medium |
5.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | poppler-0.42.0 | ❌ |
| CVE-2017-7511 | Medium |
5.5 | poppler-cairo-backendpoppler-0.24.2 | Direct | libpoppler-cpp-dev - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2;poppler-utils - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler1-glib - 0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler0c2 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2;poppler-dbg - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt-dev - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib2 - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib3 - 0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib4 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib5 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib6 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1;libpoppler-glib8 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler-cpp0 - 0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1;libpoppler1-qt4 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib-dev - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-glib-doc - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler0c2-qt - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt4-2 - 0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt4-3 - 0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt4-4 - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt5-1 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt4-dev - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt5-dev - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-private-dev - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;gir1.2-poppler-0.18 - 0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler0c2-glib - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler0 - 0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler1 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler2 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler3 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler4 - 0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler5 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler7 - 0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1;libpoppler13 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.44.0-3ubuntu2.1;libpoppler19 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler28 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler43 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler44 - 0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler46 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler49 - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler52 - 0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler56 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2;libpoppler57 - 0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler58 - 0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler61 - 0.48.0-2ubuntu2.1,0.44.0-3ubuntu2.1;libpoppler64 - 0.48.0-2ubuntu2.1;libpoppler-cpp0v5 - 0.48.0-2ubuntu2.1,0.44.0-3ubuntu2.1;libpoppler-dev - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler-qt2 - 0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2;libpoppler1-qt - 0.41.0-0ubuntu1.2,0.44.0-3ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2,0.48.0-2ubuntu2.1,0.41.0-0ubuntu1.2,0.41.0-0ubuntu1.2 | ❌ |
| CVE-2013-1789 | Low |
3.7 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.22.1 | ❌ |
| CVE-2013-7296 | Low |
3.7 | poppler-cairo-backendpoppler-0.24.2 | Direct | 0.24.5 | ❌ |
| CVE-2010-5110 | Low |
3.7 | multiple | Direct | 0.13.3 | ❌ |
Details
Partial details (19 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2019-9631
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.
Publish Date: 2019-03-08
URL: CVE-2019-9631
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2020-07-23
Fix Resolution: 0.75.0
Step up your Open Source Security Game with Mend here
CVE-2018-21009
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
Publish Date: 2019-09-05
URL: CVE-2018-21009
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21009
Release Date: 2019-09-05
Fix Resolution: 0.76.0
Step up your Open Source Security Game with Mend here
CVE-2017-15565
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
Mend Note: After conducting further research, Mend has determined that all versions of Poppler up to version poppler-0.61 are vulnerable to CVE-2017-15565.
Publish Date: 2017-10-17
URL: CVE-2017-15565
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2017-10-17
Fix Resolution: poppler-0.61
Step up your Open Source Security Game with Mend here
CVE-2019-12293
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
Publish Date: 2019-05-23
URL: CVE-2019-12293
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-12293
Release Date: 2020-07-23
Fix Resolution: evince - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9;poppler-qt - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-cpp-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;evince-browser-plugin - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-glib-debuginfo - 0.66.0-11,0.66.0-11;poppler - 0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.66.0-11,0.66.0-11,0.66.0-11,0.66.0-11;evince-dvi - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-glib-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-debugsource - 0.66.0-11,0.66.0-11;poppler-demos - 0.26.5-42,0.26.5-42,0.26.5-42;poppler-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-debuginfo - 0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.26.5-42;poppler-glib - 0.66.0-11,0.26.5-42,0.26.5-42,0.66.0-11,0.26.5-42,0.26.5-42,0.66.0-11,0.66.0-11,0.26.5-42,0.66.0-11;evince-nautilus - 3.28.2-9,3.28.2-9,3.28.2-9;poppler-qt-devel - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;poppler-utils-debuginfo - 0.66.0-11,0.66.0-11;poppler-cpp-debuginfo - 0.66.0-11,0.66.0-11;poppler-utils - 0.66.0-11,0.26.5-42,0.66.0-11,0.26.5-42,0.66.0-11,0.26.5-42,0.66.0-11;evince-debuginfo - 3.28.2-9,3.28.2-9;poppler-qt5-debuginfo - 0.66.0-11,0.66.0-11;evince-libs - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9;poppler-cpp - 0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42,0.26.5-42;evince-devel - 3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9,3.28.2-9
Step up your Open Source Security Game with Mend here
CVE-2017-2820
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library.
Publish Date: 2017-07-12
URL: CVE-2017-2820
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2015-8868
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document.
Publish Date: 2016-05-06
URL: CVE-2015-8868
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8868
Release Date: 2016-05-06
Fix Resolution: 0.40.0
Step up your Open Source Security Game with Mend here
CVE-2017-14518
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document.
Publish Date: 2017-09-17
URL: CVE-2017-14518
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2017-09-17
Fix Resolution: poppler-0.60
Step up your Open Source Security Game with Mend here
CVE-2017-14617
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
Publish Date: 2017-09-20
URL: CVE-2017-14617
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2017-09-20
Fix Resolution: poppler-0.60
Step up your Open Source Security Game with Mend here
CVE-2020-35702
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
** DISPUTED ** DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indicate that this only affects builds from Poppler git clones in late December 2020, not the 20.12.1 release. In this situation, it should NOT be considered a Poppler vulnerability. However, several third-party Open Source projects directly rely on Poppler git clones made at arbitrary times, and therefore the CVE remains useful to users of those projects.
Publish Date: 2020-12-25
URL: CVE-2020-35702
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2017-14520
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files.
Publish Date: 2017-09-17
URL: CVE-2017-14520
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2017-09-17
Fix Resolution: poppler-0.60
Step up your Open Source Security Game with Mend here
CVE-2017-9776
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
Publish Date: 2017-06-22
URL: CVE-2017-9776
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-9776
Release Date: 2017-06-22
Fix Resolution: 0.56
Step up your Open Source Security Game with Mend here
CVE-2020-27778
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
Publish Date: 2020-12-03
URL: CVE-2020-27778
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1900712
Release Date: 2020-12-03
Fix Resolution: poppler-0.76.0
Step up your Open Source Security Game with Mend here
CVE-2019-14494
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
Publish Date: 2019-08-01
URL: CVE-2019-14494
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14494
Release Date: 2019-08-01
Fix Resolution: poppler-0.79.0
Step up your Open Source Security Game with Mend here
CVE-2018-19060
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.
Publish Date: 2018-11-07
URL: CVE-2018-19060
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19060
Release Date: 2018-11-07
Fix Resolution: poppler-0.72.0
Step up your Open Source Security Game with Mend here
CVE-2017-9408
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.
Publish Date: 2017-06-02
URL: CVE-2017-9408
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9408
Release Date: 2017-06-02
Fix Resolution: 0.55
Step up your Open Source Security Game with Mend here
CVE-2017-9406
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.
Publish Date: 2017-06-02
URL: CVE-2017-9406
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9406
Release Date: 2017-06-02
Fix Resolution: 0.55
Step up your Open Source Security Game with Mend here
WS-2019-0558
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Poppler before 0.83.0 is vulnerable to uninitialized memory use in JBIG2Stream::readTextRegionSeg.
Publish Date: 2019-11-08
URL: WS-2019-0558
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/OSV-2020-1158
Release Date: 2019-11-08
Fix Resolution: poppler-0.83.0
Step up your Open Source Security Game with Mend here
CVE-2018-10768
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.
Publish Date: 2018-05-06
URL: CVE-2018-10768
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10768
Release Date: 2018-05-06
Fix Resolution: poppler-0.37
Step up your Open Source Security Game with Mend here
WS-2020-0332
Vulnerable Library - poppler-cairo-backendpoppler-0.24.2
A patchset to enable subpixel rendering of fonts via Cairo in Poppler's Qt wrapper
Library home page: https://github.com/giddie/poppler-cairo-backend.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
POPPLER in versions poppler-0.19.0 to poppler-0.84.0 is vulnerable to Use-of-uninitialized-value in BaseCryptStream related to poppler/SecurityHandler.cc.
Publish Date: 2020-01-18
URL: WS-2020-0332
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/OSV-2020-173
Release Date: 2020-01-18
Fix Resolution: poppler-0.85.0
Step up your Open Source Security Game with Mend here
ghostpdlghostscript-9.23: 30 vulnerabilities (highest severity is: 8.8)
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Vulnerable Source Files (3)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2018-17100 | High |
8.8 | ghostpdlghostscript-9.23 | Direct | v4.0.10 | ❌ |
| CVE-2018-17101 | High |
8.8 | multiple | Direct | v4.0.10 | ❌ |
| CVE-2017-5563 | High |
8.8 | multiple | Direct | Release-v4-0-8 | ❌ |
| CVE-2019-17546 | High |
8.8 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | ghostpdlghostscript-9.23 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | multiple | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | multiple | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | multiple | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | multiple | Direct | v4.2.0 | ❌ |
| CVE-2020-19131 | High |
7.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | multiple | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-2057 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-17000 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2022-2058 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2022-2056 | Medium |
6.5 | multiple | Direct | N/A | ❌ |
| CVE-2018-19210 | Medium |
6.5 | multiple | Direct | v4.0.10 | ❌ |
| CVE-2018-5784 | Medium |
6.5 | ghostpdlghostscript-9.23 | Direct | 4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | ghostpdlghostscript-9.23 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | ghostpdlghostscript-9.23 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | multiple | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | ghostpdlghostscript-9.23 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | ghostpdlghostscript-9.23 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | multiple | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | multiple | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | multiple | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | multiple | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | ghostpdlghostscript-9.23 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-34266 | Medium |
5.5 | multiple | Direct | v4.4.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | ghostpdlghostscript-9.23 | Direct | 4.0.7 | ❌ |
Details
CVE-2018-17100
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.
Publish Date: 2018-09-16
URL: CVE-2018-17100
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17100
Release Date: 2018-09-16
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-17101
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
Publish Date: 2018-09-16
URL: CVE-2018-17101
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17101
Release Date: 2018-09-16
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2022-2057
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2057
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-2058
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2058
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-2056
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Publish Date: 2022-06-30
URL: CVE-2022-2056
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-5784
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.
Publish Date: 2018-01-19
URL: CVE-2018-5784
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5784
Release Date: 2018-01-19
Fix Resolution: 4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-34266
Vulnerable Libraries - ghostpdlghostscript-9.23, ghostpdlghostscript-9.23
Vulnerability Details
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
Publish Date: 2022-07-19
URL: CVE-2022-34266
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html
Release Date: 2022-07-19
Fix Resolution: v4.4.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - ghostpdlghostscript-9.23
This is a mirror: the canonical repo is: git.ghostscript.com/ghostpdl.git https://www.ghostscript.com
Library home page: https://github.com/ArtifexSoftware/ghostpdl.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
cpythonv2.7.6: 32 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Vulnerable Source Files (2)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2022-22824 | High |
9.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2022-22822 | High |
9.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2022-22823 | High |
9.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2022-23852 | High |
9.8 | cpythonv2.7.6 | Direct | R_2_4_4 | ❌ |
| CVE-2022-25315 | High |
9.8 | cpythonv2.7.6 | Direct | cmake - 3.17.3,3.19.5,3.22.0;cmake-native - 3.17.3,3.22.0,3.20.1;python3 - 3.8.2 | ❌ |
| CVE-2016-0718 | High |
9.8 | multiple | Direct | android-6.0.1_r73 | ❌ |
| CVE-2021-3177 | High |
9.8 | cpythonv2.7.6 | Direct | python-setuptools_scm - 1.15.7-6.module;python-pluggy - 0.6.0-8.module;python3-idle - 3.6.8-37;python-funcsigs - 1.0.2-13.module;Cython-debugsource - 0.28.1-7.module,0.29.14-4.module;python3-debugsource - 3.6.8-37,3.6.8-37;python2-Cython - 0.28.1-7.module,0.28.1-7.module,0.28.1-7.module,0.28.1-7.module;platform-python-debug - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;platform-python-devel - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python2-funcsigs - 1.0.2-13.module;python3-tkinter - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python2-markupsafe - 0.23-19.module,0.23-19.module,0.23-19.module,0.23-19.module;python-lxml-debugsource - 4.2.3-4.module,4.4.1-5.module;python2-jinja2 - 2.10-8.module;python2-PyMySQL - 0.8.0-10.module;python2-numpy-doc - 1.14.2-16.module;python-attrs - 17.4.0-10.module;python-coverage - 4.5.1-4.module;python-pycparser - 2.19-3.module;python-cffi-debugsource - 1.13.2-3.module,1.13.2-3.module,1.13.2-3.module;Cython - 0.29.14-4.module,0.28.1-7.module;platform-python - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python-pymongo - 3.6.1-11.module;python2-coverage - 4.5.1-4.module,4.5.1-4.module,4.5.1-4.module,4.5.1-4.module;python2-rpm-macros - 3-38.module,3-38.module;python-backports-ssl_match_hostname - 3.5.0.1-12.module;python-markupsafe - 1.1.1-6.module,0.23-19.module;python-pytest-mock - 1.9.0-4.module;python2-attrs - 17.4.0-10.module;python2-babel - 2.5.1-9.module;python-pysocks - 1.6.8-6.module,1.7.1-4.module;python2-backports-ssl_match_hostname - 3.5.0.1-12.module;PyYAML - 3.12-16.module,5.3.1-1.module;python2-backports - 1.0-16.module,1.0-16.module,1.0-16.module,1.0-16.module;python2-debug - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-devel - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;pytz - 2017.2-12.module,2019.3-3.module;python-psycopg2 - 2.7.5-7.module,2.8.4-4.module;python2-psycopg2-debug - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-ipaddress - 1.0.18-6.module;python2-chardet - 3.0.4-10.module;python3-debuginfo - 3.6.8-37,3.6.8-37;python2-pymongo-gridfs - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python2-psycopg2 - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-sqlalchemy - 1.3.2-2.module,1.3.2-2.module,1.3.2-2.module,1.3.2-2.module;python-psutil-debugsource - 5.6.4-3.module,5.6.4-3.module,5.6.4-3.module,5.6.4-3.module;numpy-debugsource - 1.17.3-5.module;python-jinja2 - 2.10.3-4.module,2.10-8.module;python-urllib3 - 1.24.2-3.module,1.25.7-4.module;python-backports - 1.0-16.module;python-wheel - 0.31.1-2.module,0.33.6-5.module;python-ipaddress - 1.0.18-6.module;python-pymongo-debugsource - 3.6.1-11.module;python2-numpy - 1.14.2-16.module,1.14.2-16.module,1.14.2-16.module,1.14.2-16.module;python-psycopg2-doc - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-bson - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python2-idna - 2.5-7.module;python2-libs - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-lxml - 4.2.3-4.module,4.2.3-4.module,4.2.3-4.module,4.2.3-4.module;python2-mock - 2.0.0-13.module;python2-nose - 1.3.7-30.module;python2-pytz - 2017.2-12.module;python2-test - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-setuptools - 39.0.1-13.module,39.0.1-13.module;python-nose-docs - 1.3.7-30.module;python2-scipy - 1.0.0-20.module,1.0.0-20.module,1.0.0-20.module,1.0.0-20.module;python-pygments - 2.2.0-20.module;python2-tools - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python-sqlalchemy - 1.3.2-2.module;python2-psycopg2-tests - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-pluggy - 0.6.0-8.module;babel - 2.5.1-9.module,2.5.1-9.module,2.7.0-10.module;python2-wheel - 0.31.1-2.module;python2-pygments - 2.2.0-20.module;python-requests - 2.20.0-3.module,2.22.0-9.module;python-markupsafe-debugsource - 1.1.1-6.module;python-cryptography - 2.8-3.module;python2-requests - 2.20.0-3.module;python2-pymongo - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python-PyMySQL - 0.8.0-10.module,0.10.1-1.module;mod_wsgi - 4.6.8-3.module;python2-pytest-mock - 1.9.0-4.module;python2-pytest - 3.4.2-13.module;python2-pyyaml - 3.12-16.module,3.12-16.module,3.12-16.module,3.12-16.module;numpy - 1.14.2-16.module,1.17.3-5.module;python2-virtualenv - 15.1.0-19.module;python-cryptography-debugsource - 2.8-3.module,2.8-3.module,2.8-3.module;python2-pysocks - 1.6.8-6.module;python-psycopg2-debugsource - 2.7.5-7.module,2.8.4-4.module;python-dns - 1.15.0-10.module;python-ply - 3.11-10.module;scipy - 1.3.1-4.module,1.0.0-20.module;PyYAML-debugsource - 3.12-16.module,5.3.1-1.module,5.3.1-1.module,5.3.1-1.module;python2-py - 1.5.3-6.module;python-pymongo-debuginfo - 3.6.1-11.module;python-cffi - 1.13.2-3.module;python-sqlalchemy-doc - 1.3.2-2.module;python-idna - 2.5-7.module,2.8-6.module;python-lxml - 4.2.3-4.module,4.4.1-5.module;python-mock - 2.0.0-13.module;python-nose - 1.3.7-30.module;python-asn1crypto - 1.2.0-3.module;python2-numpy-f2py - 1.14.2-16.module,1.14.2-16.module,1.14.2-16.module,1.14.2-16.module;python2-dns - 1.15.0-10.module;python2-pip - 9.0.3-18.module,9.0.3-18.module;python2-six - 1.11.0-6.module,1.11.0-6.module;python2 - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python3 - 3.6.8-37;python-docutils - 0.14-12.module;python3-idle - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python3-libs - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python3-test - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python-py - 1.5.3-6.module;python-virtualenv - 15.1.0-19.module;python2-urllib3 - 1.24.2-3.module;python2-tkinter - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python-chardet - 3.0.4-19.module,3.0.4-10.module;python2-docutils - 0.14-12.module;pytest - 3.4.2-13.module;python2-setuptools_scm - 1.15.7-6.module;python-psutil - 5.6.4-3.module | ❌ |
| CVE-2017-1000158 | High |
9.8 | cpythonv2.7.6 | Direct | python2.7 - 2.7.13-4,2.7.13-4,2.7.13-4,2.7.13-2+deb9u2;python3.5 - 3.5.3-1+deb9u1 | ❌ |
| CVE-2016-5636 | High |
9.8 | cpythonv2.7.6 | Direct | 2.7.12,3.4.5,3.5.2 | ❌ |
| CVE-2022-25236 | High |
9.8 | cpythonv2.7.6 | Direct | cmake - 3.22.0,3.17.3,3.19.5;cmake-native - 3.20.1,3.17.3,3.22.0;python3 - 3.8.2 | ❌ |
| CVE-2022-25235 | High |
9.8 | cpythonv2.7.6 | Direct | cmake - 3.19.5,3.17.3,3.22.0;cmake-native - 3.22.0,3.17.3,3.20.1;python3 - 3.8.2 | ❌ |
| CVE-2022-23990 | High |
9.8 | cpythonv2.7.6 | Direct | R_2_4_4 | ❌ |
| CVE-2022-22825 | High |
8.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2022-22826 | High |
8.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2022-22827 | High |
8.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2021-45960 | High |
8.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2016-4472 | High |
8.1 | cpythonv2.7.6 | Direct | R_2_2_0 | ❌ |
| CVE-2021-46143 | High |
7.8 | cpythonv2.7.6 | Direct | expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1 | ❌ |
| CVE-2016-5300 | High |
7.5 | cpythonv2.7.6 | Direct | 2.2.0 | ❌ |
| CVE-2018-14647 | High |
7.5 | multiple | Direct | 2.7.16,3.5.0,3.5.7,3.6.7 | ❌ |
| CVE-2019-5010 | High |
7.5 | cpythonv2.7.6 | Direct | v3.6.9 | ❌ |
| CVE-2018-20843 | High |
7.5 | cpythonv2.7.6 | Direct | 2.2.7 | ❌ |
| CVE-2019-15903 | High |
7.5 | cpythonv2.7.6 | Direct | 2.2.8 | ❌ |
| CVE-2022-25314 | High |
7.5 | cpythonv2.7.6 | Direct | cmake - 3.17.3,3.22.0,3.19.5;cmake-native - 3.20.1,3.22.0,3.17.3;python3 - 3.8.2 | ❌ |
| CVE-2017-9233 | High |
7.5 | cpythonv2.7.6 | Direct | 2.2.1 | ❌ |
| CVE-2019-19274 | High |
7.5 | cpythonv2.7.6 | Direct | v3.8.0a4 | ❌ |
| WS-2016-7121 | Medium |
6.5 | cpythonv2.7.6 | Direct | cpython - v2.7.11rc1 | ❌ |
| CVE-2022-25313 | Medium |
6.5 | cpythonv2.7.6 | Direct | cmake - 3.22.0,3.19.5,3.17.3;cmake-native - 3.17.3,3.20.1,3.22.0;python3 - 3.8.2 | ❌ |
| CVE-2012-6702 | Medium |
5.9 | cpythonv2.7.6 | Direct | android-6.0.1_r78 | ❌ |
| CVE-2013-0340 | Medium |
5.6 | cpythonv2.7.6 | Direct | ROOTMAP.Dependencies - 0.1.4;expat.v141 - 2.1.0.4;expat.v142 - 2.2.7 | ❌ |
| CVE-2009-3560 | Medium |
5.3 | multiple | Direct | R_2_2_0 | ❌ |
| CVE-2013-4238 | Low |
3.7 | cpythonv2.7.6 | Direct | 3.3 | ❌ |
Details
Partial details (21 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2022-22824
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22824
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22824
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2022-22822
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22822
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22822
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2022-22823
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22823
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22823
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2022-23852
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Publish Date: 2022-01-24
URL: CVE-2022-23852
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23852
Release Date: 2022-01-24
Fix Resolution: R_2_4_4
Step up your Open Source Security Game with Mend here
CVE-2022-25315
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
Publish Date: 2022-02-18
URL: CVE-2022-25315
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-25315
Release Date: 2022-02-18
Fix Resolution: cmake - 3.17.3,3.19.5,3.22.0;cmake-native - 3.17.3,3.22.0,3.20.1;python3 - 3.8.2
Step up your Open Source Security Game with Mend here
CVE-2016-0718
Vulnerable Libraries - cpythonv2.7.6, cpythonv2.7.6, cpythonv2.7.6
Vulnerability Details
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Publish Date: 2016-05-26
URL: CVE-2016-0718
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://source.android.com/security/bulletin/2016-11-01.html
Release Date: 2016-05-26
Fix Resolution: android-6.0.1_r73
Step up your Open Source Security Game with Mend here
CVE-2021-3177
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Publish Date: 2021-01-19
URL: CVE-2021-3177
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3177
Release Date: 2021-01-19
Fix Resolution: python-setuptools_scm - 1.15.7-6.module;python-pluggy - 0.6.0-8.module;python3-idle - 3.6.8-37;python-funcsigs - 1.0.2-13.module;Cython-debugsource - 0.28.1-7.module,0.29.14-4.module;python3-debugsource - 3.6.8-37,3.6.8-37;python2-Cython - 0.28.1-7.module,0.28.1-7.module,0.28.1-7.module,0.28.1-7.module;platform-python-debug - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;platform-python-devel - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python2-funcsigs - 1.0.2-13.module;python3-tkinter - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python2-markupsafe - 0.23-19.module,0.23-19.module,0.23-19.module,0.23-19.module;python-lxml-debugsource - 4.2.3-4.module,4.4.1-5.module;python2-jinja2 - 2.10-8.module;python2-PyMySQL - 0.8.0-10.module;python2-numpy-doc - 1.14.2-16.module;python-attrs - 17.4.0-10.module;python-coverage - 4.5.1-4.module;python-pycparser - 2.19-3.module;python-cffi-debugsource - 1.13.2-3.module,1.13.2-3.module,1.13.2-3.module;Cython - 0.29.14-4.module,0.28.1-7.module;platform-python - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python-pymongo - 3.6.1-11.module;python2-coverage - 4.5.1-4.module,4.5.1-4.module,4.5.1-4.module,4.5.1-4.module;python2-rpm-macros - 3-38.module,3-38.module;python-backports-ssl_match_hostname - 3.5.0.1-12.module;python-markupsafe - 1.1.1-6.module,0.23-19.module;python-pytest-mock - 1.9.0-4.module;python2-attrs - 17.4.0-10.module;python2-babel - 2.5.1-9.module;python-pysocks - 1.6.8-6.module,1.7.1-4.module;python2-backports-ssl_match_hostname - 3.5.0.1-12.module;PyYAML - 3.12-16.module,5.3.1-1.module;python2-backports - 1.0-16.module,1.0-16.module,1.0-16.module,1.0-16.module;python2-debug - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-devel - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;pytz - 2017.2-12.module,2019.3-3.module;python-psycopg2 - 2.7.5-7.module,2.8.4-4.module;python2-psycopg2-debug - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-ipaddress - 1.0.18-6.module;python2-chardet - 3.0.4-10.module;python3-debuginfo - 3.6.8-37,3.6.8-37;python2-pymongo-gridfs - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python2-psycopg2 - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-sqlalchemy - 1.3.2-2.module,1.3.2-2.module,1.3.2-2.module,1.3.2-2.module;python-psutil-debugsource - 5.6.4-3.module,5.6.4-3.module,5.6.4-3.module,5.6.4-3.module;numpy-debugsource - 1.17.3-5.module;python-jinja2 - 2.10.3-4.module,2.10-8.module;python-urllib3 - 1.24.2-3.module,1.25.7-4.module;python-backports - 1.0-16.module;python-wheel - 0.31.1-2.module,0.33.6-5.module;python-ipaddress - 1.0.18-6.module;python-pymongo-debugsource - 3.6.1-11.module;python2-numpy - 1.14.2-16.module,1.14.2-16.module,1.14.2-16.module,1.14.2-16.module;python-psycopg2-doc - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-bson - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python2-idna - 2.5-7.module;python2-libs - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-lxml - 4.2.3-4.module,4.2.3-4.module,4.2.3-4.module,4.2.3-4.module;python2-mock - 2.0.0-13.module;python2-nose - 1.3.7-30.module;python2-pytz - 2017.2-12.module;python2-test - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python2-setuptools - 39.0.1-13.module,39.0.1-13.module;python-nose-docs - 1.3.7-30.module;python2-scipy - 1.0.0-20.module,1.0.0-20.module,1.0.0-20.module,1.0.0-20.module;python-pygments - 2.2.0-20.module;python2-tools - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python-sqlalchemy - 1.3.2-2.module;python2-psycopg2-tests - 2.7.5-7.module,2.7.5-7.module,2.7.5-7.module,2.7.5-7.module;python2-pluggy - 0.6.0-8.module;babel - 2.5.1-9.module,2.5.1-9.module,2.7.0-10.module;python2-wheel - 0.31.1-2.module;python2-pygments - 2.2.0-20.module;python-requests - 2.20.0-3.module,2.22.0-9.module;python-markupsafe-debugsource - 1.1.1-6.module;python-cryptography - 2.8-3.module;python2-requests - 2.20.0-3.module;python2-pymongo - 3.6.1-11.module,3.6.1-11.module,3.6.1-11.module,3.6.1-11.module;python-PyMySQL - 0.8.0-10.module,0.10.1-1.module;mod_wsgi - 4.6.8-3.module;python2-pytest-mock - 1.9.0-4.module;python2-pytest - 3.4.2-13.module;python2-pyyaml - 3.12-16.module,3.12-16.module,3.12-16.module,3.12-16.module;numpy - 1.14.2-16.module,1.17.3-5.module;python2-virtualenv - 15.1.0-19.module;python-cryptography-debugsource - 2.8-3.module,2.8-3.module,2.8-3.module;python2-pysocks - 1.6.8-6.module;python-psycopg2-debugsource - 2.7.5-7.module,2.8.4-4.module;python-dns - 1.15.0-10.module;python-ply - 3.11-10.module;scipy - 1.3.1-4.module,1.0.0-20.module;PyYAML-debugsource - 3.12-16.module,5.3.1-1.module,5.3.1-1.module,5.3.1-1.module;python2-py - 1.5.3-6.module;python-pymongo-debuginfo - 3.6.1-11.module;python-cffi - 1.13.2-3.module;python-sqlalchemy-doc - 1.3.2-2.module;python-idna - 2.5-7.module,2.8-6.module;python-lxml - 4.2.3-4.module,4.4.1-5.module;python-mock - 2.0.0-13.module;python-nose - 1.3.7-30.module;python-asn1crypto - 1.2.0-3.module;python2-numpy-f2py - 1.14.2-16.module,1.14.2-16.module,1.14.2-16.module,1.14.2-16.module;python2-dns - 1.15.0-10.module;python2-pip - 9.0.3-18.module,9.0.3-18.module;python2-six - 1.11.0-6.module,1.11.0-6.module;python2 - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python3 - 3.6.8-37;python-docutils - 0.14-12.module;python3-idle - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python3-libs - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python3-test - 3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37,3.6.8-37;python-py - 1.5.3-6.module;python-virtualenv - 15.1.0-19.module;python2-urllib3 - 1.24.2-3.module;python2-tkinter - 2.7.18-4.module,2.7.18-4.module,2.7.18-4.module,2.7.18-4.module;python-chardet - 3.0.4-19.module,3.0.4-10.module;python2-docutils - 0.14-12.module;pytest - 3.4.2-13.module;python2-setuptools_scm - 1.15.7-6.module;python-psutil - 5.6.4-3.module
Step up your Open Source Security Game with Mend here
CVE-2017-1000158
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
Publish Date: 2017-11-17
URL: CVE-2017-1000158
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-1000158
Release Date: 2017-11-17
Fix Resolution: python2.7 - 2.7.13-4,2.7.13-4,2.7.13-4,2.7.13-2+deb9u2;python3.5 - 3.5.3-1+deb9u1
Step up your Open Source Security Game with Mend here
CVE-2016-5636
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
Publish Date: 2016-09-02
URL: CVE-2016-5636
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-5636
Release Date: 2016-09-02
Fix Resolution: 2.7.12,3.4.5,3.5.2
Step up your Open Source Security Game with Mend here
CVE-2022-25236
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
Publish Date: 2022-02-16
URL: CVE-2022-25236
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-25236
Release Date: 2022-02-16
Fix Resolution: cmake - 3.22.0,3.17.3,3.19.5;cmake-native - 3.20.1,3.17.3,3.22.0;python3 - 3.8.2
Step up your Open Source Security Game with Mend here
CVE-2022-25235
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
Publish Date: 2022-02-16
URL: CVE-2022-25235
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-25235
Release Date: 2022-02-16
Fix Resolution: cmake - 3.19.5,3.17.3,3.22.0;cmake-native - 3.22.0,3.17.3,3.20.1;python3 - 3.8.2
Step up your Open Source Security Game with Mend here
CVE-2022-23990
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Publish Date: 2022-01-26
URL: CVE-2022-23990
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990
Release Date: 2022-01-26
Fix Resolution: R_2_4_4
Step up your Open Source Security Game with Mend here
CVE-2022-22825
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22825
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22825
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2022-22826
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22826
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22826
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2022-22827
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Publish Date: 2022-01-10
URL: CVE-2022-22827
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22827
Release Date: 2022-01-10
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2021-45960
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Publish Date: 2022-01-01
URL: CVE-2021-45960
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-45960
Release Date: 2022-01-01
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2016-4472
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
Publish Date: 2016-06-30
URL: CVE-2016-4472
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2016-06-30
Fix Resolution: R_2_2_0
Step up your Open Source Security Game with Mend here
CVE-2021-46143
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Publish Date: 2022-01-06
URL: CVE-2021-46143
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-46143
Release Date: 2022-01-06
Fix Resolution: expat - 2.2.6-2+deb10u2,2.2.10-2+deb11u1,2.2.0-2+deb9u4,2.4.3-1
Step up your Open Source Security Game with Mend here
CVE-2016-5300
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
Publish Date: 2016-06-16
URL: CVE-2016-5300
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-5300
Release Date: 2016-06-16
Fix Resolution: 2.2.0
Step up your Open Source Security Game with Mend here
CVE-2018-14647
Vulnerable Libraries - cpythonv2.7.6, cpythonv2.7.6, cpythonv2.7.6
Vulnerability Details
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
Publish Date: 2018-09-25
URL: CVE-2018-14647
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14647
Release Date: 2018-09-25
Fix Resolution: 2.7.16,3.5.0,3.5.7,3.6.7
Step up your Open Source Security Game with Mend here
CVE-2019-5010
Vulnerable Library - cpythonv2.7.6
The Python programming language
Library home page: https://github.com/python/cpython.git
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
Publish Date: 2019-10-31
URL: CVE-2019-5010
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://access.redhat.com/security/cve/cve-2019-5010
Release Date: 2019-10-31
Fix Resolution: v3.6.9
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 26 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
https://gitlab.com/libtiff/libtiff/Release-v4-0-7: 26 vulnerabilities (highest severity is: 9.8) - autoclosed
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Vulnerable Source Files (1)
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2017-9117 | High |
9.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-7 | ❌ |
| CVE-2017-5563 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-8 | ❌ |
| CVE-2017-17942 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
| CVE-2019-17546 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2019-6128 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff- v4.1.0 | ❌ |
| CVE-2018-15209 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2018-16335 | High |
8.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2020-35524 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35523 | High |
7.8 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2019-9923 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 1.32 | ❌ |
| CVE-2020-19131 | High |
7.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2022-0891 | High |
7.1 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2018-17000 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.1.0 | ❌ |
| CVE-2018-19210 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.0.10 | ❌ |
| CVE-2019-14973 | Medium |
6.5 | multiple | Direct | v4.1.0 | ❌ |
| CVE-2017-9937 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.9 | ❌ |
| CVE-2020-19144 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.54.0;tiff - 4.2.0 | ❌ |
| CVE-2017-11613 | Medium |
6.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-9 | ❌ |
| CVE-2012-3401 | Medium |
5.6 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | Release-v4-0-3 | ❌ |
| CVE-2022-22844 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2022-0908 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2 |
❌ |
| CVE-2020-35522 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2020-35521 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | v4.2.0 | ❌ |
| CVE-2022-0561 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2022-0562 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | ghostscript - 9.55.0;tiff - 4.2.0 | ❌ |
| CVE-2016-9532 | Medium |
5.5 | https://gitlab.com/libtiff/libtiff/Release-v4-0-7 | Direct | 4.0.7 | ❌ |
Details
CVE-2017-9117
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Publish Date: 2017-05-21
URL: CVE-2017-9117
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-9117
Release Date: 2017-05-21
Fix Resolution: Release-v4-0-7
Step up your Open Source Security Game with Mend here
CVE-2017-5563
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
Publish Date: 2017-01-23
URL: CVE-2017-5563
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201709-27
Release Date: 2017-01-23
Fix Resolution: Release-v4-0-8
Step up your Open Source Security Game with Mend here
CVE-2017-17942
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.
Mend Note: After conducting further research, Mend has determined that all versions of LibTIFF before version 4.0.7 are vulnerable to CVE-2017-17942.
Publish Date: 2017-12-28
URL: CVE-2017-17942
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
Release Date: 2017-12-28
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2019-17546
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Publish Date: 2019-10-14
URL: CVE-2019-17546
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17546
Release Date: 2020-08-24
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2019-6128
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Publish Date: 2019-01-11
URL: CVE-2019-6128
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6128
Release Date: 2020-08-24
Fix Resolution: libtiff- v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-15209
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Publish Date: 2018-08-08
URL: CVE-2018-15209
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209
Release Date: 2018-08-08
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2018-16335
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Publish Date: 2018-09-02
URL: CVE-2018-16335
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16335
Release Date: 2018-09-02
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2020-35524
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35524
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932044
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35523
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-03-09
URL: CVE-2020-35523
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932040
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2019-9923
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Publish Date: 2019-03-22
URL: CVE-2019-9923
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923
Release Date: 2019-03-22
Fix Resolution: 1.32
Step up your Open Source Security Game with Mend here
CVE-2020-19131
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".
Publish Date: 2021-09-07
URL: CVE-2020-19131
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19131
Release Date: 2021-09-07
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2022-0891
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Publish Date: 2022-03-10
URL: CVE-2022-0891
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0891
Release Date: 2022-03-10
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2018-17000
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Publish Date: 2018-09-13
URL: CVE-2018-17000
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000
Release Date: 2018-09-13
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2018-19210
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Publish Date: 2018-11-12
URL: CVE-2018-19210
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
Release Date: 2018-11-12
Fix Resolution: v4.0.10
Step up your Open Source Security Game with Mend here
CVE-2019-14973
Vulnerable Libraries - https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7, https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Vulnerability Details
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Publish Date: 2019-08-14
URL: CVE-2019-14973
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14973
Release Date: 2020-11-06
Fix Resolution: v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2017-9937
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (3)
Vulnerability Details
In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.
Publish Date: 2017-06-26
URL: CVE-2017-9937
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: http://bugzilla.maptools.org/show_bug.cgi?id=2707
Release Date: 2017-06-26
Fix Resolution: 4.0.9
Step up your Open Source Security Game with Mend here
CVE-2020-19144
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
Publish Date: 2021-09-09
URL: CVE-2020-19144
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-19144
Release Date: 2021-09-09
Fix Resolution: ghostscript - 9.54.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2017-11613
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Publish Date: 2017-07-26
URL: CVE-2017-11613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
Release Date: 2017-07-26
Fix Resolution: Release-v4-0-9
Step up your Open Source Security Game with Mend here
CVE-2012-3401
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Publish Date: 2012-08-13
URL: CVE-2012-3401
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://gitlab.com/libtiff/libtiff/-/tags/Release-v4-0-3
Release Date: 2012-08-13
Fix Resolution: Release-v4-0-3
Step up your Open Source Security Game with Mend here
CVE-2022-22844
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Publish Date: 2022-01-10
URL: CVE-2022-22844
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-22844
Release Date: 2022-01-10
Fix Resolution: libtiffxx5 - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff4 - 4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-3;libtiff5 - 4.2.0-1+deb11u1,4.3.0-3,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiffxx0c2 - 4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8,4.1.0+git191117-2~deb10u4;libtiff4-dev - 4.0.8-2+deb9u8,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-3;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1,4.0.8-2+deb9u8;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-3,4.0.8-2+deb9u8,4.2.0-1+deb11u1;libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.0.8-2+deb9u8,4.3.0-3
Step up your Open Source Security Game with Mend here
CVE-2022-0908
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Publish Date: 2022-03-11
URL: CVE-2022-0908
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0908
Release Date: 2022-03-11
Fix Resolution: libtiff-tools - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiffxx5 - 4.3.0-6,4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4;libtiff4 - 4.1.0+git191117-2~deb10u4,4.2.0-1+deb11u1,4.3.0-6;libtiff5 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff-opengl - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiffxx0c2 - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff4-dev - 4.2.0-1+deb11u1,4.1.0+git191117-2~deb10u4,4.3.0-6;libtiff5-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-dev - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1;libtiff-doc - 4.1.0+git191117-2~deb10u4,4.3.0-6,4.2.0-1+deb11u1
Step up your Open Source Security Game with Mend here
CVE-2020-35522
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
Publish Date: 2021-03-09
URL: CVE-2020-35522
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932037
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2020-35521
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (2)
Vulnerability Details
A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
Publish Date: 2021-03-09
URL: CVE-2020-35521
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1932034
Release Date: 2021-03-09
Fix Resolution: v4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0561
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Publish Date: 2022-02-11
URL: CVE-2022-0561
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0561
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2022-0562
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Publish Date: 2022-02-11
URL: CVE-2022-0562
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0562
Release Date: 2022-02-11
Fix Resolution: ghostscript - 9.55.0;tiff - 4.2.0
Step up your Open Source Security Game with Mend here
CVE-2016-9532
Vulnerable Library - https://gitlab.com/libtiff/libtiff/Release-v4-0-7
Library home page: https://gitlab.com/libtiff/libtiff/
Found in base branch: main
Vulnerable Source Files (1)
Vulnerability Details
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Publish Date: 2017-02-06
URL: CVE-2016-9532
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9532
Release Date: 2017-02-06
Fix Resolution: 4.0.7
Step up your Open Source Security Game with Mend here
jquery-1.11.3.min.js: 4 vulnerabilities (highest severity is: 6.1)
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Path to dependency file: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Path to vulnerable library: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Vulnerabilities
| CVE | Severity | CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2020-11023 | Medium |
6.1 | jquery-1.11.3.min.js | Direct | jquery - 3.5.0;jquery-rails - 4.4.0 | ❌ |
| CVE-2020-11022 | Medium |
6.1 | jquery-1.11.3.min.js | Direct | jQuery - 3.5.0 | ❌ |
| CVE-2015-9251 | Medium |
6.1 | jquery-1.11.3.min.js | Direct | jQuery - v3.0.0 | ❌ |
| CVE-2019-11358 | Medium |
6.1 | jquery-1.11.3.min.js | Direct | 3.4.0 | ❌ |
Details
CVE-2020-11023
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Path to dependency file: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Path to vulnerable library: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Dependency Hierarchy:
- ❌ jquery-1.11.3.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
Step up your Open Source Security Game with Mend here
CVE-2020-11022
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Path to dependency file: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Path to vulnerable library: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Dependency Hierarchy:
- ❌ jquery-1.11.3.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
Step up your Open Source Security Game with Mend here
CVE-2015-9251
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Path to dependency file: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Path to vulnerable library: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Dependency Hierarchy:
- ❌ jquery-1.11.3.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - v3.0.0
Step up your Open Source Security Game with Mend here
CVE-2019-11358
Vulnerable Library - jquery-1.11.3.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js
Path to dependency file: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Path to vulnerable library: /ImageMagick-7.0.5-4/ImageMagick/api/resource.html
Dependency Hierarchy:
- ❌ jquery-1.11.3.min.js (Vulnerable Library)
Found in base branch: main
Vulnerability Details
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
Release Date: 2019-04-20
Fix Resolution: 3.4.0
Step up your Open Source Security Game with Mend here
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.