Packages
- vips - image processing system good for very large ones
Details
It was discovered that libvips incorrectly handled certain PDF files with a
page that defines a width but not a height. An attacker could possibly use
this issue to cause libvips to crash, resulting in a denial of service, or
obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2025-59933)
It was discovered that libvips incorrectly determined image dimensions in
the vipsload operation, leading to an integer overflow. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33327)
It was discovered that libvips incorrectly determined image dimensions in
the gifload operation on 32-bit systems, leading to an integer overflow. An
attacker could possibly use this...
It was discovered that libvips incorrectly handled certain PDF files with a
page that defines a width but not a height. An attacker could possibly use
this issue to cause libvips to crash, resulting in a denial of service, or
obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2025-59933)
It was discovered that libvips incorrectly determined image dimensions in
the vipsload operation, leading to an integer overflow. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33327)
It was discovered that libvips incorrectly determined image dimensions in
the gifload operation on 32-bit systems, leading to an integer overflow. An
attacker could possibly use this issue to cause libvips to crash, resulting
in a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-33328)
It was discovered that libvips did not properly validate EXIF tag groups.
An attacker could possibly use this issue to cause libvips to crash,
resulting in a denial of service. (CVE-2026-35590)
It was discovered that libvips incorrectly determined the number of
channels in certain encoded tiles within TIFF images. An attacker could
possibly use this issue to cause libvips to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591)
It was discovered that libvips incorrectly validated scanlines in certain
TIFF images with many bands, leading to an integer overflow. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, obtain sensitive information, or possibly execute
arbitrary code. (CVE-2026-69242)
It was discovered that libvips incorrectly calculated frame heights when
loading certain multi-page TIFF images through ImageMagick. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service. (CVE-2026-70651)
It was discovered that libvips incorrectly handled certain Radiance images.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-70653)
It was discovered that libvips incorrectly calculated read sizes when
processing certain uncompressed PPM images from custom sources. An attacker
could possibly use this issue to cause libvips to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-70654)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | libvips42t64 – 8.18.0-1ubuntu0.1~esm2 | ||
| 24.04 LTS noble | libvips42t64 – 8.15.1-1.1ubuntu0.1~esm2 | ||
| 22.04 LTS jammy | libvips42 – 8.12.1-1ubuntu0.1~esm3 | ||
| 20.04 LTS focal | libvips42 – 8.9.1-2ubuntu0.1~esm2 | ||
| 18.04 LTS bionic | libvips42 – 8.4.5-1ubuntu0.1~esm2 | ||
| 16.04 LTS xenial | libvips42 – 8.2.2-1ubuntu0.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.