CVE-2020-20739
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an...
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
CVE-2020-20739- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-909
- Updated
- 2026-11-02
CVE List No score
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
CVE-2020-20739- Updated
- 2026-11-02
EUVDEUVD-2020-13519 No score
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
EUVD-2020-13519- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-62hp-w5vm-g7xm
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an...
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
GHSA-62hp-w5vm-g7xm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-908, CWE-909
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-20739
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
ALPINE-CVE-2020-20739- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
CVE-2020-20739- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-20739
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
DEBIAN-CVE-2020-20739- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-20739
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
- Record
UBUNTU-CVE-2020-20739- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUSN-6437-1 No score
vips vulnerabilities
Ziqiang Gu discovered that VIPS could be made to dereference a NULL pointer. If a user or automated system were tricked into processing a specially crafted input image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)
It was discovered that VIPS did not properly handle uninitialized memory locations when processing corrupted input image data. An attacker could possibly use this issue to generate output images that expose sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-6976)
It was discovered that VIPS did not properly manage memory due to an uninitialized variable. If a user or automated system were tricked into processing a specially crafted output file, an attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-20739)
It was discovered that VIPS could be made to divide by zero in multiple funcions. If a user or automated system were tricked into processing a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-27847)
It was discovered that VIPS did not properly handle certain input files that contained malformed UTF-8 characters. If a user or automated system were tricked into processing a specially crafted SVG image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-40032)
- Record
USN-6437-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vipsAlpine:v3.15 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.16 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.17 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.18 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.19 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.20 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.21 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.22 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.23 |
before 8.9.0-r0 | 8.9.0-r0 |
vipsAlpine:v3.24 |
before 8.9.0-r0 | 8.9.0-r0 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
vipsDebian:12 |
before 8.9.0-1 | 8.9.0-1 |
vipsDebian:13 |
before 8.9.0-1 | 8.9.0-1 |
vipsDebian:14 |
before 8.9.0-1 | 8.9.0-1 |
vipsDebian:9 |
before 8.4.5-1+deb9u2, plus listed versions 8.4.5-18.4.5-1+deb9u1 |
8.4.5-1+deb9u2 |
vipsUbuntu:Pro:16.04:LTS |
before 8.2.2-1ubuntu0.1~esm1, plus listed versions 7.40.6-2ubuntu28.0.2-28.2.1-18.2.2-1 |
8.2.2-1ubuntu0.1~esm1 |
vipsUbuntu:Pro:18.04:LTS |
before 8.4.5-1ubuntu0.1~esm1, plus listed versions 8.4.5-1build1 |
8.4.5-1ubuntu0.1~esm1 |
vipsUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 8.2.2-1ubuntu0.1~esm1, plus listed versions 7.40.6-2ubuntu28.0.2-28.2.1-18.2.2-1 |
8.2.2-1ubuntu0.1~esm1 |
vipsUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 8.4.5-1ubuntu0.1~esm1, plus listed versions 8.4.5-1build1 |
8.4.5-1ubuntu0.1~esm1 |
vipsUbuntu:Pro:22.04:LTS From an advisory covering 5 CVEs |
before 8.12.1-1ubuntu0.1~esm1, plus listed versions 8.10.5-2ubuntu18.11.4-28.12.1-18.12.1-1build1 |
8.12.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-20739 is a medium vulnerability (CVSS 5.3) in Libvips, published November 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in vips 8.9.0-r0.
References
github.com/libvips/libvips/issues/1419
lists.debian.org/debian-lts-announce/2020/11/msg00049.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQCXFYBUXEM7UXJAOKLSP
nvd.nist.gov/vuln/detail/CVE-2020-20739
Show 10 moreShow less
security.alpinelinux.org/vuln/CVE-2020-20739
security-tracker.debian.org/tracker/CVE-2020-20739
ubuntu.com/security/CVE-2020-20739
cve.org/CVERecord?id=CVE-2020-20739