Memory Allocation Failure in libtiff Leads to Denial of Service (CVE-2020-35521)
Summary
CVE-2020-35521: A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service. Affects tiff across 2 version ranges.
< 4.2.0-r0
< 4862b0d7bcc786304ff4e8c31e8d5ccfb868fb99
Fixed in 4.2.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is an open-source library used for reading and writing TIFF image files. It provides various functions and utilities for handling TIFF files in different applications. However, a vulnerability has been discovered in libtiff that can result in a denial of service (DoS) attack. This vulnerability is identified as CVE-2020-35521.
Vulnerability Detail
The vulnerability in libtiff is caused by a memory allocation failure in the tif_read.c file. An attacker can exploit this flaw by crafting a malicious TIFF file. When this file is processed by an application using libtiff, it can trigger an abort, leading to a DoS condition. The impact of this vulnerability is the unavailability of the affected application, potentially disrupting critical operations.
How To Fix
Minimum fixed version
4.2.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the libtiff package to the latest version.
Conclusion
The vulnerability in libtiff can be exploited to cause a denial of service (DoS) attack. To mitigate this risk, it is crucial to update the libtiff package to version 4.2.0-r0 or later. This update includes a patch that addresses the memory allocation failure. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
libtiff is an open-source library used for reading and writing TIFF image files. It provides various functions and utilities for handling TIFF files in different applications.
The vulnerability in libtiff can lead to a denial of service (DoS) condition. It can cause the affected application to become unavailable, potentially disrupting critical operations.
To fix this vulnerability, update the libtiff package to version 4.2.0-r0 or later. This update includes a patch that addresses the memory allocation failure and prevents the DoS attack.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the libtiff package to the latest version.
Users can obtain the updated libtiff package from the official Alpine package repository or the libtiff GitLab repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
