GNOME Evince up to 3.32.0 TIFF File tiff_document_render/tiff_document_get_thumbnail Image File uninitialized pointer

Summaryinfo

A vulnerability marked as problematic has been reported in GNOME Evince up to 3.32.0. Impacted is the function tiff_document_render/tiff_document_get_thumbnail of the component TIFF File Handler. This manipulation as part of Image File causes uninitialized pointer. This vulnerability appears as CVE-2019-11459. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability was found in GNOME Evince up to 3.32.0. It has been declared as problematic. Affected by this vulnerability is the function tiff_document_render/tiff_document_get_thumbnail of the component TIFF File Handler. The manipulation as part of a Image File leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. As an impact it is known to affect availability. The summary by CVE is:

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

The bug was discovered 04/13/2019. The weakness was presented 04/22/2019 (Website). It is possible to read the advisory at seclists.org. This vulnerability is known as CVE-2019-11459 since 04/22/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 216432 (Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Atril vulnerabilities (USN-7274-1)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197442 (Ubuntu Security Notification for Evince Vulnerability (USN-3959-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (216432). See VDB-137807 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• GNOME

Name

• Evince

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32.0

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion