CVE-2019-6128

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.maptools.org/show_bug.cgi?id=2836Exploit, Issue Tracking, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.htmlThird Party Advisory, VDB Entry
https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00027.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/5Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202003-25Third Party Advisory
https://usn.ubuntu.com/3906-1/Third Party Advisory
https://usn.ubuntu.com/3906-2/Third Party Advisory
http://bugzilla.maptools.org/show_bug.cgi?id=2836Exploit, Issue Tracking, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.htmlThird Party Advisory, VDB Entry
https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00027.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/5Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202003-25Third Party Advisory
https://usn.ubuntu.com/3906-1/Third Party Advisory
https://usn.ubuntu.com/3906-2/Third Party Advisory

Timeline

Published: Jan 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-61296.5png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think CVE-2019-61305.5Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page CVE-2019-61315.5svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as CVE-2019-61327.5An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4Descrip CVE-2019-61336.7In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authoriza CVE-2019-61357.5An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called from Asn1PrimitiveValu CVE-2019-61367.5An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a SEGV, as demonstrated CVE-2019-61377.5An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.CVE-2019-61387.5An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory leaks when called from CVE-2019-61399.8Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitat CVE-2019-61409.8A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hyb CVE-2019-61426.1It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply th