Critical Vulnerability in TIFF Package: Denial of Service Risk Due to Undefined Behavior
Summary
ALPINE-CVE-2017-7601: LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact... Affects tiff versions < 4.0.7-r2. Fixed in 4.0.7-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF (Tagged Image File Format) package is widely used for storing raster graphics images, including photographs and line art. It supports various color spaces and is known for its flexibility and high-quality image storage. However, the package has been found to have a significant vulnerability that can lead to application crashes and potential exploitation by attackers.
Vulnerability Detail
LibTIFF version 4.0.7 contains a vulnerability characterized by 'shift exponent too large for 64-bit type long' which results in undefined behavior. This flaw can be exploited by remote attackers through specially crafted images, leading to denial of service (application crashes) or potentially other unspecified impacts. The vulnerability is classified under CVE-2017-7601 and has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
4.0.7-r2
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted TIFF images until the package is updated. This can help mitigate the risk of exploitation while waiting for the patch to be applied.
Conclusion
The vulnerability in the TIFF package poses a significant risk to applications that process TIFF images. It is crucial to update to the patched version to mitigate potential denial of service attacks. Users are encouraged to monitor their systems and apply updates promptly.
See every vulnerability recorded for tiff →
FAQ
CVE-2017-7601 is a vulnerability in the LibTIFF library that can lead to denial of service due to undefined behavior when processing certain TIFF images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, refrain from using untrusted TIFF images to minimize the risk of exploitation.
The primary impact is denial of service, which can cause application crashes. There may also be other unspecified impacts that could arise from exploitation.
More details can be found in the official CVE database or by visiting the vulnerability report at https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2017-7601.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
