Integer Overflow Vulnerability in TIFF Package: CVE-2019-14973
Summary
ALPINE-CVE-2019-14973: _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. Affects tiff versions < 4.0.10-r1. Fixed in 4.0.10-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package is a widely used library for handling Tagged Image File Format (TIFF) images. It provides functionalities for reading and writing TIFF files, making it essential for applications that require image processing. The library is known for its versatility and support for various image compression formats. However, it is susceptible to vulnerabilities that can compromise application stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2019-14973 arises from improper handling of Integer Overflow checks in the functions _TIFFCheckMalloc and _TIFFCheckRealloc within the tif_aux.c file of the LibTIFF library, up to version 4.0.10. This flaw relies on compiler behavior that is not defined by the C standards, potentially leading to application crashes and unexpected behavior. Attackers could exploit this vulnerability to disrupt services or cause denial of service.
How To Fix
Minimum fixed version
4.0.10-r1
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider implementing input validation to ensure that the parameters passed to the TIFF functions do not lead to integer overflow. However, this is not a substitute for applying the patch.
Conclusion
In summary, CVE-2019-14973 is a significant vulnerability in the TIFF package that can lead to application instability. It is essential to update to the patched version to ensure the security and reliability of applications utilizing this library. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software integrity.
See every vulnerability recorded for tiff →
FAQ
CVE-2019-14973 is a vulnerability in the TIFF package that can lead to application crashes due to improper integer overflow checks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The CVSS score for CVE-2019-14973 is 6.5, indicating a medium severity level.
Exploitation of this vulnerability can lead to application crashes, service disruptions, and potential denial of service attacks.
Implementing input validation can help mitigate the risk temporarily, but it is crucial to apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
