CVE-2020-19131: Buffer Overflow

Reference Links

• http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/
• http://bugzilla.maptools.org/show_bug.cgi?id=2831
• https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html
• https://www.ibm.com/support/pages/node/7177223 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7177223

Frequently Asked Questions

• What is the severity of CVE-2020-19131?

  CVE-2020-19131 has a severity rating of medium due to its potential to cause a denial of service.

• How do I fix CVE-2020-19131?

  To fix CVE-2020-19131, apply the latest patches provided by IBM for Cognos Analytics and update LibTiff to a version higher than 4.0.10.

• What types of software are affected by CVE-2020-19131?

  CVE-2020-19131 affects LibTiff version 4.0.10, and IBM Cognos Analytics versions 11.2.0 to 11.2.4 FP4 and 12.0.0 to 12.0.3.

• What component is responsible for the vulnerability in CVE-2020-19131?

  The vulnerability in CVE-2020-19131 is caused by a heap-based buffer overflow in the "invertImage()" function within the "tiffcrop" component.

• Can CVE-2020-19131 lead to remote attacks?

  Yes, CVE-2020-19131 can lead to remote denial of service attacks if a victim is tricked into opening a specially crafted TIFF image.