Critical Out-of-Bounds Write Vulnerability in TIFF Package - CVE-2018-17101
Summary
ALPINE-CVE-2018-17101: An issue was discovered in LibTIFF 4.0.9. Affects tiff versions < 4.0.9-r8. Fixed in 4.0.9-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package is a widely used library for handling Tagged Image File Format (TIFF) images, which are commonly utilized in various applications for storing high-quality images. The library provides functionalities for reading and writing TIFF files, making it essential for image processing tasks. However, it has been found to contain a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
An issue was discovered in LibTIFF version 4.0.9, where two out-of-bounds writes in the functions cpTags located in tools/tiff2bw.c and tools/pal2rgb.c can occur. This vulnerability can cause a denial of service (application crash) or potentially allow for unspecified other impacts when processing a crafted image file. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
4.0.9-r8
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to ensure that only trusted image files are processed. Additionally, you can restrict access to the application to mitigate potential exploitation.
Conclusion
The CVE-2018-17101 vulnerability in the TIFF package poses significant risks due to potential out-of-bounds writes that can lead to application crashes or other impacts. It is crucial to update to the patched version to mitigate these risks effectively.
See every vulnerability recorded for tiff →
FAQ
CVE-2018-17101 is a critical vulnerability found in the LibTIFF library that can lead to out-of-bounds writes, causing application crashes or other impacts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-17101 is 8.8, indicating a high severity level.
If you cannot update the package, implement input validation and restrict access to the application to reduce the risk of exploitation.
You can visit Vulert's website at https://vulert.com for real-time monitoring and alerts on open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
