← Back

CVE-2019-11459

nvd nist
Published: Apr 22, 2019Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

Affected (23)

Products: Gnome: Evince · Canonical: Ubuntu Linux · Fedoraproject: Fedora · +3 more
Show all products
Gnome: Evince · Canonical: Ubuntu Linux · Fedoraproject: Fedora · Debian: Debian Linux · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Server Aus, Enterprise Linux Server Tus · Opensuse: Leap
Gnome
1 product
Evince
Canonical
1 product
Ubuntu Linux
Fedoraproject
1 product
Fedora
Debian
1 product
Debian Linux
Redhat
4 products
Enterprise Linux
Enterprise Linux Eus
Enterprise Linux Server Aus
Enterprise Linux Server Tus
Opensuse
1 product
Leap
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Evince
Up to 3.32.0
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 16.04
Ubuntu Linux
Version 18.04
Ubuntu Linux
Version 18.10
Ubuntu Linux
Version 19.04
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 29
Fedora
Version 30
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 8.0
Debian Linux
Version 9.0
Configuration E
11 vulnerable
Vulnerable SoftwareAffected Versions
Enterprise Linux
Version 8.0
Redhat
Enterprise Linux Eus
Version 8.1
Enterprise Linux Eus
Version 8.2
Enterprise Linux Eus
Version 8.4
Enterprise Linux Eus
Version 8.6
Redhat
Enterprise Linux Server Aus
Version 8.2
Enterprise Linux Server Aus
Version 8.4
Enterprise Linux Server Aus
Version 8.6
Redhat
Enterprise Linux Server Tus
Version 8.2
Enterprise Linux Server Tus
Version 8.4
Enterprise Linux Server Tus
Version 8.6
Configuration F
2 vulnerable
Vulnerable SoftwareAffected Versions
Opensuse
Leap
Version 15.0
Leap
Version 15.1

Related CWEs

CWE-754
Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-908
Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.

References (20)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.