CVE-2019-14973: debian debian_linux Integer Overflow or Wraparound
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2019-14973SUSE-SU-2020:2744-1RHSA-2020:1688UBUNTU-CVE-2019-14973DEBIAN-CVE-2019-14973DLA-1897-1openSUSE-SU-2020:1561-1openSUSE-SU-2020:1840-1
Published 14-08-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-14973 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 4.20% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
4.20%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 14-08-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
CVSS metrics
7 scores · 5 sources · 3 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LSources2 sources · 4.5–6.5
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.20%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.20% on 18-09-2026
18-09-202618-10-2026
EPSS score4.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- libtiff< 0:4.0.9-17.el8
- libtiff-debuginfo< 0:4.0.9-17.el8
- libtiff-debugsource< 0:4.0.9-17.el8
- libtiff-devel< 0:4.0.9-17.el8
- libtiff-tools< 0:4.0.9-17.el8
Suse6 products
- tiff&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 4.0.9-5.30.28
- tiff&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 4.0.9-5.30.28
- tiff&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 4.0.9-5.30.28
- tiff&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 4.0.9-5.30.28
- tiff&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1< 4.0.9-5.30.28
Opensuse3 products
- leapEOL15.1 | 15.2
- tiff&distro=openSUSE Leap 15.1< 4.0.9-lp151.10.3.1
- tiff&distro=openSUSE Leap 15.2< 4.0.9-lp152.11.3.1
Debian2 products
- tiff< 4.0.10+git190814-1 | < 4.0.3-12.3+deb8u9
- debian_linuxEOL8.0 | 9.0 | 10.0
Alpine1 product
- tiff< 4.0.10-r1
Fedoraproject1 product
- fedoraEOL30 | 31
Libtiff1 product
- libtiff≤ 4.0.10
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.11+esm6 | < 4.0.6-1ubuntu0.7 | < 4.0.9-5ubuntu0.3
8 vendors · 21 products
References
29 links
lists.debian.org/debian-lts-announce/2019/08/msg00031.htmlMailing ListX Refsource MLISTThird Party Advisory- packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 29 references
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory