CVE-2020-20739: Medium severity libvips libvips vulnerability
imvips2dz in /libvips/libvips/deprecated/imvips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vipsto a version that resolves this vulnerability.Fixed in 8.7.4-1+deb10u1Fixed in 8.10.5-2Fixed in 8.14.1-3+deb12u1Fixed in 8.15.1-1Fixed in 8.15.2-1 - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.4.5-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.9.0-1 - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.2.2-1ubuntu0.1~ - Upgrade
Upgrade
alpine/vipsto a version that resolves this vulnerability.Fixed in 8.9.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-20739?
CVE-2020-20739 is a vulnerability in the libvips library before version 8.8.2 that may cause the leakage of remote server path or stack address.
What is the severity of CVE-2020-20739?
CVE-2020-20739 has a severity level of 5.3, which is considered medium.
Which software versions are affected by CVE-2020-20739?
CVE-2020-20739 affects libvips versions up to, but not including, 8.8.2.
How do I fix CVE-2020-20739?
To fix CVE-2020-20739, update libvips to version 8.8.2 or later.
Where can I find more information about CVE-2020-20739?
You can find more information about CVE-2020-20739 at the following references: [link1], [link2], [link3].