Heap Buffer Overflow in LibTIFF tools/tiffcp
Summary
CVE-2017-5225: LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value. Affects tiff across 3 version ranges.
< 4.0.7-r1
< 5c080298d59efa53264d7248bbe3a04660db6ef7
< 884f973652b8b020e533b1e340da3ef4bcd1d925
Fixed in 4.0.7-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibTIFF is an open-source library for reading and writing TIFF image files. It provides support for various compression schemes and color spaces. The vulnerability affects version 4.0.7 of the library and specifically impacts the tools/tiffcp component. This component is responsible for copying TIFF files, and the vulnerability arises from a heap buffer overflow. The vulnerability can be exploited by providing a crafted BitsPerSample value, leading to a denial-of-service (DoS) condition or potential code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5225, originates from a heap buffer overflow in the tools/tiffcp component of LibTIFF. By supplying a specially crafted BitsPerSample value, an attacker can trigger the overflow. This can result in a DoS condition, causing the application to crash, or potentially allow the execution of arbitrary code. The severity of this vulnerability is rated as critical, with a CVSS v3 score of 9.8.
How To Fix
Minimum fixed version
4.0.7-r1
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The heap buffer overflow vulnerability in LibTIFF's tools/tiffcp component can result in a DoS condition or potential code execution. It is crucial to update the LibTIFF library to version 4.0.7-r1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
LibTIFF is an open-source library for reading and writing TIFF image files. It provides support for various compression schemes and color spaces.
The vulnerability affects the tools/tiffcp component of LibTIFF, which is responsible for copying TIFF files.
The vulnerability can lead to a denial-of-service (DoS) condition or potential code execution if exploited successfully.
The severity of this vulnerability is rated as critical, with a CVSS v3 score of 9.8.
To fix this vulnerability, it is recommended to update the LibTIFF library to version 4.0.7-r1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
