CVE Database›Document archive›CVE-2019-6128

CVE-2019-6128

libtiff: memory leak in TIFFFdOpen function in tif_unix.c when using pal2rgb

Loading…

Severity

Moderate

Red Hat Product Security

6.5

CVSS 3.1

Review impact separately from score.

Published · January 4, 2019

Updated · June 27, 2026

Description

A vulnerability was found in LibTIFF, where a memory leak in the TIFFFdOpen function within tif_unix.c could lead to a denial of service, where a remote attacker could exploit this flaw by tricking a user into opening a specially crafted file, causing increased memory consumption and potential application instability over time.

Statement

This vulnerability is rated as moderate because a memory leak in LibTIFF’s TIFFFdOpen function within tif_unix.c could lead to a denial of service, exploitation requires user interaction, as an attacker must persuade a victim to open a specially crafted file. While this does not lead to code execution, repeated exploitation could impact application availability.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

This bug could be mitigated by configuring process memory limits using cgroups.

CVSS / CWE

CVSS 3.1 · 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')