CVE-2023-40032
Potential segfault due to NULL pointer dereference in libvips
Summary
Potential segfault due to NULL pointer dereference in libvips
Original description
The description as published by the source.
libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-40032 vips Fixed in: 8.14.1-3+deb12u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web lists.fedoraproject.org