CVE-2019-6976

libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.

• CWE-908

• https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/Technical Description, Third Party Advisory
• https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0aPatch, Third Party Advisory
• https://github.com/libvips/libvips/releases/tag/v8.7.4Third Party Advisory
• https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/Technical Description, Third Party Advisory
• https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0aPatch, Third Party Advisory
• https://github.com/libvips/libvips/releases/tag/v8.7.4Third Party Advisory

Published

Jan 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6970Moodle 3.5.x before 3.5.4 allows SSRF.
• CVE-2019-6971An issue was discovered on TP-Link TL-WR1043ND V2 devices. A…
• CVE-2019-6972An issue was discovered on TP-Link TL-WR1043ND V2 devices. T…
• CVE-2019-6973Sricam IP CCTV cameras are vulnerable to denial of service v…
• CVE-2019-6974In the Linux kernel before 4.20.8, kvm_ioctl_create_device i…8.1
• CVE-2019-6975Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x…
• CVE-2019-6977gdImageColorMatch in gd_color_match.c in the GD Graphics Lib…
• CVE-2019-6978The GD Graphics Library (aka LibGD) 2.2.5 has a double free …
• CVE-2019-6979An issue was discovered in the User IP History Logs (aka IP_…
• CVE-2019-6980Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allo…
• CVE-2019-6981Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind…
• CVE-2019-6982An issue was discovered in Foxit 3D Plugin Beta before 9.4.0…