CVE-2019-6976 Information disclosure in n/a
Attackers can leak raw process memory contents by providing corrupted image data to the libvips library, potentially exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-6976?
CVE-2019-6976 is a medium-severity vulnerability in n/a, published on 26 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
Weakness: CWE-908
Which versions are affected by CVE-2019-6976?
It affects 1 product.
Products include Libvips Libvips.
How do I fix CVE-2019-6976?
Upgrade to a fixed version.
Is CVE-2019-6976 being exploited?
There is no known exploitation of CVE-2019-6976 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-17534 Use after free in n/a
- CVE-2026-33327 Possible integer overflow leading to potential heap-based buffer overflow
- CVE-2026-35591 Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile
- CVE-2026-33328 Possible integer overflow on 32-bit systems when reading GIF images
- CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata
Sources
Also known as DEBIAN-CVE-2019-6976, GHSA-589q-f3gp-p53f, UBUNTU-CVE-2019-6976.