Heap-Based Buffer Over-Read in TIFF Package: CVE-2018-10779
Summary
ALPINE-CVE-2018-10779: TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. Affects tiff versions < 4.0.9-r8. Fixed in 4.0.9-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package is a widely used library for handling Tagged Image File Format (TIFF) images, which are commonly utilized in various applications for storing high-quality images. This package provides functionalities for reading and writing TIFF files, making it essential for image processing tasks. However, it has been identified to have a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10779, originates from a flaw in the TIFFWriteScanline function within the tif_write.c file of the LibTIFF library version 3.8.2. This flaw allows for a heap-based buffer over-read, which can potentially lead to unauthorized access to sensitive data or application crashes. Attackers can exploit this vulnerability by crafting specific input files, which may result in data leakage or application instability.
How To Fix
Minimum fixed version
4.0.9-r8
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider restricting access to the TIFF processing functionalities or validating input files more rigorously to prevent exploitation until the package can be updated.
Conclusion
In summary, CVE-2018-10779 represents a significant vulnerability in the TIFF package that can lead to serious security implications. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tiff →
FAQ
CVE-2018-10779 is a vulnerability in the TIFF package that allows for a heap-based buffer over-read, potentially leading to data leakage or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2018-10779 is 6.5, indicating a medium severity level.
If immediate updates are not possible, consider implementing stricter input validation or limiting access to the TIFF functionalities as a temporary measure.
You can find more information about the TIFF package and its functionalities in the official documentation or repositories related to the LibTIFF library.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
