CVE-2020-20739: Debian Linux

Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days.

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only
• Libvips Libvips: before 8.8.2 (fixed in 8.8.2)

Published 2020-11-20. Last modified 2026-06-17.