CVE-2019-11459: canonical ubuntu_linux
CVSS: 5.5v3.1MediumModified
AliasesMGASA-2019-0355SUSE-SU-2019:1648-1UBUNTU-CVE-2019-11459USN-3959-1DEBIAN-CVE-2019-11459openSUSE-SU-2019:1667-1
Published 22-04-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-11459 is a medium (CVSS 5.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
1.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 12 · Related 7Timeline
- 22-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.44%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.44% on 19-09-2026
19-09-202619-10-2026
EPSS score1.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.
Affected systems
Redhat4 products
- enterprise_linux8.0
- enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
- enterprise_linux_server_aus8.2 | 8.4 | 8.6
- enterprise_linux_server_tus8.2 | 8.4 | 8.6
Debian3 products
- atril< 1.22.3-1
- evince< 3.32.0-3
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse3 products
- leapEOL15.0 | 15.1
- evince&distro=openSUSE Leap 15.0< 3.26.0+20180128.1bd86963-lp151.4.3.1
- evince&distro=openSUSE Leap 15.1< 3.26.0+20180128.1bd86963-lp151.4.3.1
Suse2 products
- evince&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 3.26.0+20180128.1bd86963-4.7.3
- evince&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 3.26.0+20180128.1bd86963-4.7.3
Ubuntu2 products
- atril< 1.20.1-2ubuntu2+esm2
- evince< 3.18.2-1ubuntu4.4 | < 3.28.4-0ubuntu1.1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10 | 19.04
Fedoraproject1 product
- fedoraEOL29 | 30
Gnome1 product
- evince≤ 3.32.0
Mageia1 product
- evince< 3.32.1-1.mga7
9 vendors · 18 products
References
23 links- lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/08/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2019/08/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 23 references
- lists.opensuse.org/archives/…Advisory