Memory Leak Vulnerability in LibTIFF Package: CVE-2019-6128
Summary
ALPINE-CVE-2019-6128: The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. Affects tiff versions < 4.0.10-r3. Fixed in 4.0.10-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LibTIFF is a widely-used library for reading and writing TIFF (Tagged Image File Format) files. It provides essential functionalities for image processing and is integral to many applications that handle image data. The library is known for its efficiency and support for various image formats, but it has been found to have vulnerabilities that can lead to severe security issues.
Vulnerability Detail
The vulnerability identified as CVE-2019-6128 is a memory leak in the TIFFFdOpen function located in tif_unix.c of LibTIFF version 4.0.10. This flaw can lead to increased memory consumption, potentially exhausting system resources and causing applications to crash or behave unpredictably. The vulnerability arises from improper handling of memory allocation, which does not release memory after it is no longer needed. This can be exploited by attackers to create denial-of-service conditions or to manipulate application behavior.
How To Fix
Minimum fixed version
4.0.10-r3
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the usage of the affected function or avoid using the library in scenarios where memory management is critical until the package is updated. Additionally, monitoring memory usage can help mitigate the impact of this vulnerability.
Conclusion
The CVE-2019-6128 vulnerability in the LibTIFF package poses significant risks due to its memory leak issue. It is crucial for users to update to the patched versions to safeguard their applications against potential exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tiff →
FAQ
CVE-2019-6128 is a memory leak vulnerability found in the LibTIFF library, specifically in the TIFFFdOpen function.
This vulnerability can lead to increased memory usage, potentially causing applications to crash or become unresponsive.
Versions prior to 4.0.10-r3 for Alpine v3.10 and versions prior to 4.1.0-r0 for Alpine v3.11 and later are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider limiting the use of the affected function and monitoring your application's memory usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
