{"id":"CVE-2019-6976","aliases":["DEBIAN-CVE-2019-6976","EUVD-2019-16528","GHSA-589q-f3gp-p53f","UBUNTU-CVE-2019-6976","USN-6437-1","openSUSE-SU-2026:12266-1"],"status":"published","title":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing...","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02207,"percentile":0.82806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2019-01-26T23:00:00Z","modified":"2026-10-25T17:41:57Z","fixes":[{"ecosystem":"Debian:12","package":"vips","fixed_in":["8.7.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vips","fixed_in":["8.7.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vips","fixed_in":["8.7.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","fixed_in":["8.2.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","fixed_in":["8.4.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.4-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1ubuntu0.1~esm1"}]}],"versions":["8.10.5-2ubuntu1","8.11.4-2","8.12.1-1","8.12.1-1build1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.7-1.1"}]}],"bundled":9}],"products":[{"vendor":"libvips","product":"libvips"}],"references":[{"url":"https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/libvips/libvips/releases/tag/v8.7.4","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6976"},{"url":"https://github.com/advisories/GHSA-589q-f3gp-p53f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6976","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6976","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6437-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-20739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-27847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40032","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70654","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6976","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:00:00Z","modified":"2024-08-04T20:38:32.597Z","updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-16528","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:00:00Z","modified":"2024-08-04T20:38:32Z","updated_at":"2026-11-03T03:06:47.494697Z"}],"ghsa":[{"id":"GHSA-589q-f3gp-p53f","title":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing...","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2022-05-13T01:22:47Z","modified":"2023-02-01T05:07:12Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:50:30.001937Z"}],"nvd":[{"id":"CVE-2019-6976","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:29:00.237Z","modified":"2026-06-17T02:39:51.55Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"CVE-2019-6976","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:29:00.237Z","modified":"2026-10-25T17:41:57.93710251Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6976","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:29:00.237Z","modified":"2026-09-21T07:00:26.029236456Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-6976","description":"libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.","status":"published","published":"2019-01-26T23:29:00Z","modified":"2026-04-22T12:20:22.655104Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"openSUSE-SU-2026:12266-1","title":"libvips-devel-8.18.7-1.1 on GA media","description":"These are all security issues fixed in the libvips-devel-8.18.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-24T00:00:00Z","modified":"2026-10-25T17:30:03.892254255Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"USN-6437-1","title":"vips vulnerabilities","description":"Ziqiang Gu discovered that VIPS could be made to dereference a NULL \npointer. If a user or automated system were tricked into processing \na specially crafted input image file, an attacker could possibly use\nthis issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)\n\nIt was discovered that VIPS did not properly handle uninitialized memory\nlocations when processing corrupted input image data. An attacker could \npossibly use this issue to generate output images that expose sensitive \ninformation. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2019-6976)\n\nIt was discovered that VIPS did not properly manage memory due to an \nuninitialized variable. If a user or automated system were tricked into \nprocessing a specially crafted output file, an attacker could possibly \nuse this issue to expose sensitive information. \nThis issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2020-20739)\n\nIt was discovered that VIPS could be made to divide by zero in multiple \nfuncions. If a user or automated system were tricked into processing a \nspecially crafted image file, an attacker could possibly use this issue \nto cause a denial of service. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2021-27847)\n\nIt was discovered that VIPS did not properly handle certain input files \nthat contained malformed UTF-8 characters. If a user or automated system \nwere tricked into processing a specially crafted SVG image file, an \nattacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-40032)\n","status":"published","published":"2023-10-18T14:40:28Z","modified":"2026-06-25T13:30:28.141211564Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}