Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11459: The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. 1716295: CVE-2019-11459 evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | evince | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-browser-plugin | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-debuginfo | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-devel | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-dvi | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-libs | 0:3.28.2-9.amzn2 |
| Amazon Linux · 2 | evince-nautilus | 0:3.28.2-9.amzn2 |
Vulnerabilities 1
-
Unscored —
The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince thr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-11459.html