Critical Buffer Overflow Vulnerability in TIFF Package - CVE-2018-18557
Summary
ALPINE-CVE-2018-18557: LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-siz... Affects tiff versions < 4.0.10-r0. Fixed in 4.0.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF (Tagged Image File Format) package is widely used for storing raster graphics images, including photographs and line art. It supports multiple layers and channels, making it a versatile choice for image processing. However, certain versions of the TIFF library are vulnerable to a buffer overflow issue that can lead to severe security risks.
Vulnerability Detail
LibTIFF versions 3.9.3 through 4.0.9, when JBIG is enabled, are susceptible to a buffer overflow vulnerability. This flaw allows the decoding of arbitrarily-sized JBIG images into a buffer without respecting the buffer size, leading to out-of-bounds writes. Such vulnerabilities can be exploited by attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
4.0.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable JBIG support in the TIFF library if it is not required for your application. This can be done by modifying the build configuration to exclude JBIG support, thus mitigating the risk until the package is updated.
Conclusion
The CVE-2018-18557 vulnerability in the TIFF package poses a significant risk due to its potential for arbitrary code execution. It is crucial for users to update to the patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tiff →
FAQ
CVE-2018-18557 is a critical vulnerability in the TIFF package that allows for buffer overflow due to improper handling of JBIG images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially allowing attackers to gain unauthorized access to systems.
Yes, the patch is available in version 4.0.10-r0 and later of the TIFF package.
If immediate updates are not possible, consider disabling JBIG support as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
