CVE-2023-40032

Katalog CVE

CVSS 5.5 · Medium EPSS 0,25%

Kerentanan NULL Pointer Dereference pada fedoraproject fedora, libvips. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

Rincian

Terbit di NVD

11 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libvips/libvips/security/advisories/GHSA-33qp-9pq7-9584 mitigasi · patch · advisory vendor
• https://github.com/libvips/libvips/commit/e091d65835966ef56d53a4105a7362cafdb1582b patch
• https://github.com/libvips/libvips/pull/3604 patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU2FFC47X2XDEGE... mailing list