Denial of Service Vulnerability in TIFF Package: CVE-2017-7592
Summary
ALPINE-CVE-2017-7592: The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified oth... Affects tiff versions < 4.0.7-r2. Fixed in 4.0.7-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package is a widely used library for handling TIFF (Tagged Image File Format) images. It provides functionalities for reading and writing TIFF files, which are commonly used in various applications, including image processing and printing. The library is known for its versatility and support for multiple image formats. However, it has been identified to have a vulnerability that can lead to application crashes when processing specially crafted images.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7592, originates from the putagreytile function in tif_getimage.c within LibTIFF version 4.0.7. This issue involves left-shift undefined behavior, which can be exploited by remote attackers. By sending a crafted image, attackers may cause a denial of service (application crash) or potentially other unspecified impacts. The severity of this vulnerability is reflected in its CVSS score of 7.8, indicating a high risk to applications utilizing this library.
How To Fix
Minimum fixed version
4.0.7-r2
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid processing untrusted TIFF images until the package is updated. This will help mitigate the risk of exploitation while a permanent fix is being applied.
Conclusion
CVE-2017-7592 is a significant vulnerability in the TIFF package that can lead to denial of service through crafted images. It is crucial to update to the patched version to ensure the security of applications relying on this library. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tiff →
FAQ
CVE-2017-7592 is a vulnerability in the TIFF package that can lead to application crashes when processing specially crafted images.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
The CVSS score of CVE-2017-7592 is 7.8, indicating a high severity level.
If immediate updates are not possible, avoid processing untrusted TIFF images as a temporary workaround to mitigate risks.
You can find more information about the TIFF package and its functionalities in the official documentation or repositories related to LibTIFF.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
