CVE-2019-14973

_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.

• CWE-190

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.htmlThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/merge_requests/90Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00031.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/
• https://seclists.org/bugtraq/2019/Nov/5Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/32Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4608Third Party Advisory
• https://www.debian.org/security/2020/dsa-4670Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.htmlThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/merge_requests/90Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00031.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/
• https://seclists.org/bugtraq/2019/Nov/5Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2020/Jan/32Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4608Third Party Advisory
• https://www.debian.org/security/2020/dsa-4670Third Party Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14966An issue was discovered in Frappe Framework 10 through 12 be…
• CVE-2019-14967An issue was discovered in Frappe Framework 10, 11 before 11…
• CVE-2019-14968An issue was discovered in imcat 4.9. There is SQL Injection…
• CVE-2019-14969Netwrix Auditor before 9.8 has insecure permissions on %PROG…
• CVE-2019-1497Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14970A vulnerability in mkv::event_thread_t in VideoLAN VLC media…
• CVE-2019-14974SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-…
• CVE-2019-14975Artifex MuPDF before 1.16.0 has a heap-based buffer over-rea…
• CVE-2019-14976iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords…
• CVE-2019-14977Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14978/payu/icpcheckout/ in the WooCommerce PayU India Payment Gat…
• CVE-2019-14979cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout …