CVE-2019-11459

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

• CWE-754
• CWE-908

• https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.htmlMailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3553Third Party Advisory
• https://gitlab.gnome.org/GNOME/evince/issues/1129Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00013.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00014.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/
• https://seclists.org/bugtraq/2020/Feb/18Mailing List, Third Party Advisory
• https://usn.ubuntu.com/3959-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4624Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.htmlMailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3553Third Party Advisory
• https://gitlab.gnome.org/GNOME/evince/issues/1129Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00013.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00014.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/
• https://seclists.org/bugtraq/2020/Feb/18Mailing List, Third Party Advisory
• https://usn.ubuntu.com/3959-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4624Third Party Advisory

Published

Apr 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11452whatsns 4.0 allows index.php?admin_category/remove.html cid[…
• CVE-2019-11454Persistent cross-site scripting (XSS) in http/cervlet.c in T…6.1
• CVE-2019-11455A buffer over-read in Util_urlDecode in util.c in Tildeslash…8.1
• CVE-2019-11456Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary …
• CVE-2019-11457Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 …8.8
• CVE-2019-11458An issue was discovered in SmtpTransport in CakePHP 3.7.6. A…
• CVE-2019-1146A remote code execution vulnerability exists when the Window…7.8
• CVE-2019-11460An issue was discovered in GNOME gnome-desktop 3.26, 3.28, a…
• CVE-2019-11461An issue was discovered in GNOME Nautilus 3.30 prior to 3.30…
• CVE-2019-11463A memory leak in archive_read_format_zip_cleanup in archive_…5.5
• CVE-2019-11464Some enterprises require that REST API endpoints include sec…6.1
• CVE-2019-11465An issue was discovered in Couchbase Server 5.5.x through 5.…5.3