Memory malloc failure in LibTIFF tif_pixarlog.c
Summary
CVE-2020-35522: In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. Affects tiff across 2 version ranges.
< 4.2.0-r0
< 4862b0d7bcc786304ff4e8c31e8d5ccfb868fb99
Fixed in 4.2.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibTIFF is an open-source library for reading and writing TIFF image files. It provides support for various compression schemes and image formats. The vulnerability affects the tif_pixarlog.c file in LibTIFF, which is responsible for handling PixarLog-encoded TIFF images.
Vulnerability Detail
The vulnerability (CVE-2020-35522) in LibTIFF is caused by a memory malloc failure in the tif_pixarlog.c file. An attacker can exploit this vulnerability by crafting a malicious TIFF document. When the vulnerable code attempts to allocate memory, it fails, leading to an abort and resulting in a remote denial of service attack. The impact of this vulnerability is a complete denial of service, rendering the affected system unresponsive.
How To Fix
Minimum fixed version
4.2.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the LibTIFF package to the patched version.
Conclusion
The memory malloc failure vulnerability in LibTIFF's tif_pixarlog.c file can be exploited by a crafted TIFF document, leading to a remote denial of service attack. To mitigate this vulnerability, it is crucial to update the LibTIFF package to version 4.2.0-r0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
LibTIFF is an open-source library for reading and writing TIFF image files. It provides support for various compression schemes and image formats.
The vulnerability can be exploited to cause a remote denial of service attack, resulting in the affected system becoming unresponsive.
To fix this vulnerability, update the LibTIFF package to version 4.2.0-r0 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the LibTIFF package.
The updated LibTIFF package can be obtained from the official Alpine package repository or the LibTIFF GitLab repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
