Moderate: libtiff security update
Summary
ALSA-2022:1810: Moderate: libtiff security update. Affects libtiff versions < 4.0.9-21.el8. Fixed in 4.0.9-21.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff package is a library of functions used for manipulating Tagged Image File Format (TIFF) files. It provides various features for reading, writing, and manipulating TIFF images. The package is commonly used in applications that deal with image processing and editing. However, a vulnerability has been discovered in libtiff that could potentially lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in libtiff, identified as CVE-2020-19131, is a buffer overflow issue that can be exploited through the "invertImage()" function. An attacker could craft a malicious TIFF file that triggers the buffer overflow when processed by an application using libtiff. This could result in a crash or the execution of arbitrary code, potentially leading to a DoS attack. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
4.0.9-21.el8
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk.
Conclusion
The libtiff package contains a vulnerability that could potentially lead to a denial of service (DoS) attack. It is crucial to update the package to the latest version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libtiff →
FAQ
Libtiff is a library for manipulating TIFF files, commonly used in image processing applications.
The vulnerability could lead to a denial of service (DoS) attack by crashing or executing arbitrary code.
You can fix this vulnerability by updating the libtiff package to version 4.0.9-21.el8 or later.
No, there is no known workaround. Updating the package is the recommended solution.
You can find more information about this vulnerability in the CVE page linked in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
