{"id":"USN-6437-1","summary":"vips vulnerabilities","details":"Ziqiang Gu discovered that VIPS could be made to dereference a NULL \npointer. If a user or automated system were tricked into processing \na specially crafted input image file, an attacker could possibly use\nthis issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)\n\nIt was discovered that VIPS did not properly handle uninitialized memory\nlocations when processing corrupted input image data. An attacker could \npossibly use this issue to generate output images that expose sensitive \ninformation. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2019-6976)\n\nIt was discovered that VIPS did not properly manage memory due to an \nuninitialized variable. If a user or automated system were tricked into \nprocessing a specially crafted output file, an attacker could possibly \nuse this issue to expose sensitive information. \nThis issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2020-20739)\n\nIt was discovered that VIPS could be made to divide by zero in multiple \nfuncions. If a user or automated system were tricked into processing a \nspecially crafted image file, an attacker could possibly use this issue \nto cause a denial of service. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2021-27847)\n\nIt was discovered that VIPS did not properly handle certain input files \nthat contained malformed UTF-8 characters. If a user or automated system \nwere tricked into processing a specially crafted SVG image file, an \nattacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-40032)\n","modified":"2026-04-22T10:41:17.201028Z","published":"2023-10-18T14:40:28Z","related":["UBUNTU-CVE-2018-7998","UBUNTU-CVE-2019-6976","UBUNTU-CVE-2020-20739","UBUNTU-CVE-2021-27847","UBUNTU-CVE-2023-40032"],"upstream":["CVE-2018-7998","CVE-2019-6976","CVE-2020-20739","CVE-2021-27847","CVE-2023-40032","UBUNTU-CVE-2018-7998","UBUNTU-CVE-2019-6976","UBUNTU-CVE-2020-20739","UBUNTU-CVE-2021-27847","UBUNTU-CVE-2023-40032"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6437-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-7998"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-6976"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-20739"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-27847"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40032"}],"affected":[{"package":{"name":"vips","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/vips@8.2.2-1ubuntu0.1~esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"],"ecosystem_specific":{"binaries":[{"binary_version":"8.2.2-1ubuntu0.1~esm1","binary_name":"gir1.2-vips-8.0"},{"binary_version":"8.2.2-1ubuntu0.1~esm1","binary_name":"libvips-tools"},{"binary_version":"8.2.2-1ubuntu0.1~esm1","binary_name":"libvips42"},{"binary_version":"8.2.2-1ubuntu0.1~esm1","binary_name":"python-vipscc"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2018-7998","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2019-6976","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2020-20739","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2021-27847","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6437-1.json"}},{"package":{"name":"vips","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/vips@8.4.5-1ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"8.4.5-1ubuntu0.1~esm1","binary_name":"gir1.2-vips-8.0"},{"binary_version":"8.4.5-1ubuntu0.1~esm1","binary_name":"libvips-tools"},{"binary_version":"8.4.5-1ubuntu0.1~esm1","binary_name":"libvips42"},{"binary_version":"8.4.5-1ubuntu0.1~esm1","binary_name":"python-vipscc"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2018-7998","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2019-6976","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2020-20739","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2021-27847","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6437-1.json"}},{"package":{"name":"vips","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/vips@8.12.1-1ubuntu0.1~esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1ubuntu0.1~esm1"}]}],"versions":["8.10.5-2ubuntu1","8.11.4-2","8.12.1-1","8.12.1-1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"8.12.1-1ubuntu0.1~esm1","binary_name":"gir1.2-vips-8.0"},{"binary_version":"8.12.1-1ubuntu0.1~esm1","binary_name":"libvips-tools"},{"binary_version":"8.12.1-1ubuntu0.1~esm1","binary_name":"libvips42"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2023-40032","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:Pro:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6437-1.json"}}],"schema_version":"1.7.5"}