Uninitialized Memory Leak in libvips
Summary
CVE-2019-6976: libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. Affects vips across 3 version ranges.
< 8.7.4-1
< 849d24472eabb349b6695d3ec30d544766d32d0f
< 00622428bda8d7521db8d74260b519fa41d69d0a
Fixed in 8.7.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libvips is an open-source image processing library used by various applications. It provides a wide range of image manipulation functions and is commonly used for tasks such as resizing, cropping, and converting images. However, a vulnerability has been discovered in versions before 8.7.4 that can lead to the leakage of uninitialized memory contents through the output image. This can occur when processing corrupted input image data, as the library fails to zero out allocated memory. The vulnerability has been assigned the CVE identifier CVE-2019-6976.
Vulnerability Detail
The vulnerability in libvips arises from the improper handling of memory allocation. When processing corrupted input image data, the library does not properly initialize the allocated memory. As a result, the output image may contain fragments of uninitialized memory, potentially exposing sensitive information. An attacker could exploit this vulnerability to leak the contents of raw process memory through the manipulated output image. The impact of this vulnerability is considered low, as it requires the use of corrupted input data and the likelihood of exposing sensitive information is relatively low.
How To Fix
Minimum fixed version
8.7.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vipsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement additional input validation and sanitization measures to minimize the risk of encountering corrupted input image data. By carefully validating and filtering input images, the likelihood of triggering the vulnerability can be reduced. However, this workaround does not address the underlying issue and should be considered a temporary solution until the library is updated to a fixed version.
Conclusion
The vulnerability in libvips can lead to the leakage of uninitialized memory contents through manipulated output images. It is recommended to update to libvips version 8.7.4 or later to fix this vulnerability. In the meantime, implementing additional input validation measures can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vips →
FAQ
libvips is an open-source image processing library used for various image manipulation tasks.
The impact of this vulnerability is considered low, as it requires the use of corrupted input data and the likelihood of exposing sensitive information is relatively low.
To fix this vulnerability, update to libvips version 8.7.4 or later.
A temporary workaround is to implement additional input validation and sanitization measures.
The updated version of libvips can be obtained from the official libvips website or through the package manager.
Related vulnerabilities
Recent vulnerabilities recorded for vips.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
