Published: 22/04/2019 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince up to and including 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome evince
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
canonical ubuntu linux 19.04
fedoraproject fedora 29
fedoraproject fedora 30
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 10.0
redhat enterprise linux 8.0
redhat enterprise linux eus 8.1
redhat enterprise linux eus 8.2
redhat enterprise linux server tus 8.2
redhat enterprise linux server aus 8.2
redhat enterprise linux server tus 8.4
redhat enterprise linux eus 8.4
redhat enterprise linux server aus 8.4
redhat enterprise linux server aus 8.6
redhat enterprise linux server tus 8.6
redhat enterprise linux eus 8.6
opensuse leap 15.0
opensuse leap 15.1

Debian Bug report logs - #927820 evince: CVE-2019-11459: Uninitialized memory read Package: src:evince; Maintainer for src:evince is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 23 Apr 2019 19:57:01 UTC Severity: important T ...

Evince could be made to expose sensitive information if it received a specially crafted file ...

Several vulnerabilities were discovered in evince, a simple multi-page document viewer CVE-2017-1000159 Tobias Mueller reported that the DVI exporter in evince is susceptible to a command injection vulnerability via specially crafted filenames CVE-2019-11459 Andy Nguyen reported that the tiff_document_render() and tiff_docume ...

Synopsis Low: GNOME security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic An update for GNOME is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base sc ...

Synopsis Moderate: poppler and evince security update Type/Severity Security Advisory: Moderate Topic An update for poppler and evince is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ...

Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3320 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files (CVE-2019-11459) ...

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3320 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files (CVE-2019-11459) Poppler before 0660 has an integer overflow in Parser::makeStream ...

CWE-754 CWE-908 https://gitlab.gnome.org/GNOME/evince/issues/1129 https://usn.ubuntu.com/3959-1/http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html https://access.redhat.com/errata/RHSA-2019:3553 https://www.debian.org/security/2020/dsa-4624 https://seclists.org/bugtraq/2020/Feb/18 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927820 https://usn.ubuntu.com/3959-1/https://nvd.nist.gov

CVE-2019-11459

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect