Heap Buffer Overflow Vulnerability in TIFF Package - CVE-2017-5225
Summary
ALPINE-CVE-2017-5225: LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value. Affects tiff versions < 4.0.7-r1. Fixed in 4.0.7-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package is a widely used library for handling Tagged Image File Format (TIFF) images. It provides functionalities for reading and writing TIFF files, making it essential for applications that require image processing. However, the library has been found to have a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp, which can be exploited through a crafted BitsPerSample value. This vulnerability can result in Denial of Service (DoS) or even arbitrary code execution, posing significant risks to systems that utilize this library. The vulnerability is classified under CVE-2017-5225 and has a CVSS score of 9.8, indicating its critical nature.
How To Fix
Minimum fixed version
4.0.7-r1
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tiffcp tool until the package is updated to a secure version. Additionally, restricting access to the application that utilizes the vulnerable library can help mitigate potential exploitation.
Conclusion
The TIFF package has a critical vulnerability (CVE-2017-5225) that can lead to severe security issues, including DoS and code execution. It is crucial to update to the patched version 4.0.7-r1 to mitigate these risks. Users should also consider temporary workarounds while ensuring their systems remain secure.
See every vulnerability recorded for tiff →
FAQ
CVE-2017-5225 is a vulnerability in the LibTIFF library that allows for a heap buffer overflow, potentially leading to DoS or code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include potential Denial of Service (DoS) and arbitrary code execution, which can compromise system integrity and security.
Yes, the patched version of the TIFF package is 4.0.7-r1. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider restricting access to the application using the vulnerable library and avoid using the tiffcp tool until the update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
