CVE-2020-19131

CVE	CVE-2020-19131
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-09-07 15:15:00 UTC
Updated	2021-12-01 14:18:00 UTC
Description	Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".

Problem Types: CWE-787

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	Simplesystems	Libtiff	4.0.10	All	All	All

Reference	Source	Link	Tags
天融信关于LibTiff中invertImage函数堆溢出漏洞的分析 \| 天融信阿尔法实验室	MISC	blog.topsec.com.cn
[SECURITY] [DLA 2777-1] tiff security update	MLIST	lists.debian.org
Bug 2831 – tiffcrop.c:9206:heap buffer overflow in invertImage	MISC	bugzilla.maptools.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

159809 Oracle Enterprise Linux Security Update for libtiff (ELSA-2022-1810)
178835 Debian Security Update for tiff (DLA 2777-1)
198944 Ubuntu Security Notification for LibTIFF Vulnerabilities (USN-5619-1)
240290 Red Hat Update for libtiff (RHSA-2022:1810)
671250 EulerOS Security Update for libtiff (EulerOS-SA-2022-1175)
671269 EulerOS Security Update for compat-libtiff3 (EulerOS-SA-2022-1159)
671345 EulerOS Security Update for libtiff (EulerOS-SA-2022-1274)
671349 EulerOS Security Update for compat-libtiff3 (EulerOS-SA-2022-1264)
751716 SUSE Enterprise Linux Security Update for tiff (SUSE-SU-2022:0480-1)
751721 SUSE Enterprise Linux Security Update for tiff (SUSE-SU-2022:0496-1)
751752 OpenSUSE Security Update for tiff (openSUSE-SU-2022:0480-1)
940521 AlmaLinux Security Update for libtiff (ALSA-2022:1810)
960131 Rocky Linux Security Update for libtiff (RLSA-2022:1810)