Integer Overflow Vulnerability in libtiff
Summary
CVE-2020-35523: An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. Affects tiff across 2 version ranges.
< 4.2.0-r0
< c8d613ef497058fe653c467fc84c70a62a4a71b2
Fixed in 4.2.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is an open-source library used for reading and writing TIFF image files. It provides various functions and utilities for manipulating TIFF files. However, a vulnerability has been discovered in libtiff that allows an attacker to execute arbitrary code by exploiting an integer overflow flaw in the tif_getimage.c file. This vulnerability affects the confidentiality, integrity, and availability of systems that use libtiff.
Vulnerability Detail
The integer overflow vulnerability in libtiff arises due to a flaw in the tif_getimage.c file. When a user opens a crafted TIFF file, an attacker can inject and execute arbitrary code. This can lead to unauthorized access, data leakage, and system compromise. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
4.2.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the libtiff package to the recommended version.
Conclusion
The integer overflow vulnerability in libtiff poses a significant risk to the confidentiality, integrity, and availability of systems. It is crucial to update the libtiff package to the recommended version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
libtiff is an open-source library used for reading and writing TIFF image files. It provides various functions and utilities for manipulating TIFF files.
The vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data leakage, and system compromise.
To fix this vulnerability, update the libtiff package to version 4.2.0-r0 or later.
No, there is no known workaround for this vulnerability. Updating the libtiff package is the recommended solution.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
