Vulnerability · Published Nov 20, 2020 · Assigned by mitre
CVE-2020-20739
Medium 5.3
In plain English
A medium-severity security flaw in the vips package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.8%top 21.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | vips | 8.9.0-r0 | ALPINE-CVE-2020-20739 |
| Alpine:v3.21 | vips | 8.9.0-r0 | ALPINE-CVE-2020-20739 |
| Alpine:v3.22 | vips | 8.9.0-r0 | ALPINE-CVE-2020-20739 |
| Alpine:v3.23 | vips | 8.9.0-r0 | ALPINE-CVE-2020-20739 |
| Alpine:v3.24 | vips | 8.9.0-r0 | ALPINE-CVE-2020-20739 |
| Debian:12 | vips | 8.9.0-1 | DEBIAN-CVE-2020-20739 |
| Debian:13 | vips | 8.9.0-1 | DEBIAN-CVE-2020-20739 |
| Debian:14 | vips | 8.9.0-1 | DEBIAN-CVE-2020-20739 |
Affected products (as reported)
References
- https://github.com/libvips/libvips/issues/1419 x_refsource_MISC
- https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031a x_refsource_MISC
- [debian-lts-announce] 20201130 [SECURITY] [DLA 2473-1] vips security update mailing-list, x_refsource_MLIST
- FEDORA-2020-d82261f7b1 vendor-advisory, x_refsource_FEDORA