Out-of-Memory Vulnerability in TIFF Package: Denial of Service Risk
Summary
DEBIAN-CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. Affects tiff versions < 4.5.1+git230720-4. Fixed in 4.5.1+git230720-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The TIFF package is a widely used library for handling Tagged Image File Format (TIFF) images. It provides functionalities for reading and writing TIFF files, making it essential for applications that process image data. However, this package has been found to have a critical vulnerability that could be exploited by attackers to cause service disruptions.
Vulnerability Detail
An out-of-memory flaw was discovered in the libtiff library, specifically in the TIFFRasterScanlineSize64() API. This vulnerability can be triggered by passing a specially crafted TIFF file, which may lead to a denial of service. The flaw allows remote attackers to exploit the library by providing input that is smaller than 379 KB, potentially crashing the application or causing it to become unresponsive.
How To Fix
Minimum fixed version
4.5.1+git230720-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted TIFF files until the package is updated. Implementing input validation to check the size and integrity of TIFF files before processing can also mitigate the risk.
Conclusion
The out-of-memory vulnerability in the TIFF package poses a significant risk of denial of service through crafted TIFF files. Users are strongly advised to update to the latest patched version to protect their applications from potential exploitation. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for tiff →
FAQ
The vulnerability is an out-of-memory flaw that can lead to denial of service when processing specially crafted TIFF files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can cause applications to crash or become unresponsive, leading to service disruptions.
Yes, a patched version of the TIFF package (4.5.1+git230720-4) is available. Users should update to this version to mitigate the risk.
If immediate updates are not possible, avoid processing untrusted TIFF files and implement input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
