CVE-2020-20739

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
VendorProductVersion
libvipslibvips
𝑥
< 8.8.2
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vips
bullseye
8.10.5-2
fixed
bookworm
8.14.1-3+deb12u1
fixed
trixie
8.15.3-1
fixed
sid
8.16.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vips
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
bionic
Fixed 8.4.5-1ubuntu0.1~esm1
released
xenial
Fixed 8.2.2-1ubuntu0.1~esm1
released
trusty
dne
Common Weakness Enumeration
References
https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031a
https://github.com/libvips/libvips/issues/1419
https://lists.debian.org/debian-lts-announce/2020/11/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQCXFYBUXEM7UXJAOKLSP/
https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031a
https://github.com/libvips/libvips/issues/1419
https://lists.debian.org/debian-lts-announce/2020/11/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQCXFYBUXEM7UXJAOKLSP/