Out-of-Bounds Read Vulnerability in TIFF Package - CVE-2023-1916
Summary
DEBIAN-CVE-2023-1916: A flaw was found in tiffcrop, a program distributed by the libtiff package. Affects tiff versions < 4.7.0-1. Fixed in 4.7.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TIFF package, specifically the libtiff library, is widely used for handling TIFF (Tagged Image File Format) images. It provides tools for reading and writing TIFF files, making it essential for applications that require image processing. The package includes various utilities, including tiffcrop, which is used to crop TIFF images. However, a flaw in tiffcrop has been identified, exposing users to potential security risks.
Vulnerability Detail
A flaw was discovered in tiffcrop, a utility within the libtiff package. This vulnerability arises from the handling of specially crafted TIFF files, which can lead to an out-of-bounds read in the extractImageSection function located in tools/tiffcrop.c. The consequences of this flaw include denial of service and limited information disclosure, affecting libtiff versions 4.x. Attackers could exploit this vulnerability to manipulate TIFF files, potentially leading to application crashes or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
4.7.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted TIFF files with the tiffcrop utility until the package is updated. Additionally, implementing strict file validation can help mitigate the risk of exploitation.
Conclusion
The CVE-2023-1916 vulnerability in the TIFF package poses significant risks due to its potential for denial of service and information disclosure. Users are strongly advised to update to the patched version 4.7.0-1 to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tiff →
FAQ
CVE-2023-1916 is a security vulnerability in the TIFF package that allows for an out-of-bounds read, potentially leading to denial of service and limited information disclosure.
The vulnerability affects libtiff versions 4.x.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the tiffcrop utility with untrusted TIFF files and consider implementing strict file validation.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-1916.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
