Heap-based Buffer Overflow in libtiff TIFF2PDF Tool
Summary
CVE-2020-35524: A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. Affects tiff across 3 version ranges.
< 4.2.0-r0
< 7be2e452ddcf6d7abca88f41d3761e6edab72b22
< 4862b0d7bcc786304ff4e8c31e8d5ccfb868fb99
Fixed in 4.2.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff package is a library for reading and writing TIFF (Tagged Image File Format) files. It provides support for various compression schemes and image formats. The TIFF2PDF tool, included in libtiff, allows users to convert TIFF images to PDF format. However, a vulnerability has been discovered in the handling of TIFF images by the TIFF2PDF tool.
Vulnerability Detail
The vulnerability, identified as CVE-2020-35524, is a heap-based buffer overflow flaw in libtiff's TIFF2PDF tool. An attacker can exploit this flaw by providing a specially crafted TIFF file, which can lead to arbitrary code execution. The impact of this vulnerability is significant, as it can compromise the confidentiality, integrity, and availability of the affected system.
How To Fix
Minimum fixed version
4.2.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the libtiff package to the fixed version.
Conclusion
The heap-based buffer overflow vulnerability in libtiff's TIFF2PDF tool can have severe consequences for the affected system's confidentiality, integrity, and availability. It is crucial to update the libtiff package to the fixed version and rebuild any dependent applications or systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
Libtiff is a library for reading and writing TIFF files, which are commonly used for storing images. It provides support for various compression schemes and image formats.
TIFF2PDF is a tool included in the libtiff package that allows users to convert TIFF images to PDF format.
A heap-based buffer overflow is a type of vulnerability where an attacker can overwrite data in the heap memory of a program, potentially leading to arbitrary code execution.
An attacker can exploit this vulnerability by providing a specially crafted TIFF file to the TIFF2PDF tool, which can trigger the heap-based buffer overflow and allow arbitrary code execution.
This vulnerability can compromise the confidentiality, integrity, and availability of the affected system. An attacker can potentially execute arbitrary code, leading to unauthorized access or control of the system.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
