CVE-2019-11459

MEDIUM

GNOME Evince <3.32.0 - Memory Corruption

Title source: llm
STIX 2.1

Description

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

References (10)

Core 10
Core References
Patch, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/evince/issues/1129
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3959-1/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3553
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4624
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2020/Feb/18

Scores

CVSS v3 5.5
EPSS 0.0044
EPSS Percentile 63.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-754 CWE-908
Status published
Products (23)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
canonical/ubuntu_linux 19.04
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 29
fedoraproject/fedora 30
gnome/evince < 3.32.0
... and 13 more
Published Apr 22, 2019
Tracked Since Feb 18, 2026