CVE-2020-20739

Katalog CVE

CVSS 5.3 · Medium EPSS 2,0%

Kerentanan Missing Initialization of Resource pada libvips, debian linux +1 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.

Rincian

Terbit di NVD

20 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-909: Missing Initialization of Resource

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/commit/2ab5aa7bf515135c2b02d42e9a72e4c98e17031a patch
• https://lists.debian.org/debian-lts-announce/2020/11/msg00049.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZULVPQQ4QDFSQ... mailing list · advisory pihak ketiga
• https://github.com/libvips/libvips/issues/1419 exploit · issue tracking