CVE-2023-40032

2023-09-1100:00:00

ubuntu.com

libvips

image processing

vulnerability

versions 8.14.3

security update

svg input

utf-8

segfault

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

libvips is a demand-driven, horizontally threaded image processing library.
A specially crafted SVG input can cause libvips versions 8.14.3 or earlier
to segfault when attempting to parse a malformed UTF-8 character. Users
should upgrade to libvips version 8.14.4 (or later) when processing
untrusted input.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchvips< 8.12.1-1ubuntu0.1~esm1UNKNOWN
ubuntu23.10noarchvips< anyUNKNOWN
ubuntu24.04noarchvips< anyUNKNOWN