CVE-2019-6128
libtiff: memory leak in TIFFFdOpen function in tif_unix.c when using pal2rgb
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 4, 2019
Updated · June 27, 2026
Description
A vulnerability was found in LibTIFF, where a memory leak in the TIFFFdOpen function within tif_unix.c could lead to a denial of service, where a remote attacker could exploit this flaw by tricking a user into opening a specially crafted file, causing increased memory consumption and potential application instability over time.
Statement
This vulnerability is rated as moderate because a memory leak in LibTIFF’s TIFFFdOpen function within tif_unix.c could lead to a denial of service, exploitation requires user interaction, as an attacker must persuade a victim to open a specially crafted file. While this does not lead to code execution, repeated exploitation could impact application availability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
This bug could be mitigated by configuring process memory limits using cgroups.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')