Vulnerability in tiff - security update
Summary
DLA-1346-1: tiff - security update. Affects tiff versions < 4.0.2-6+deb7u19. Fixed in 4.0.2-6+deb7u19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tiff package is a library and tools for reading and writing Tagged Image File Format (TIFF) files. It provides support for various compression schemes and color spaces. The vulnerability affects the tiffinfo tool, which is used to print TIFF information. The tool contains a NULL Pointer Dereference vulnerability in the TIFFPrintDirectory function. This vulnerability can be exploited by remote attackers to cause a crash of the application.
Vulnerability Detail
The vulnerability in the tiff package arises from a NULL Pointer Dereference in the TIFFPrintDirectory function of the tiffinfo tool. When processing crafted TIFF information, remote attackers can trigger this vulnerability to crash the application. The impact of this vulnerability is limited to a denial of service, as it causes the application to crash. However, it is important to note that this vulnerability can be exploited remotely.
How To Fix
Minimum fixed version
4.0.2-6+deb7u19
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the tiff package is vulnerable to a NULL Pointer Dereference issue in the TIFFPrintDirectory function of the tiffinfo tool. This vulnerability can be exploited remotely to cause a denial of service by crashing the application. Users are advised to upgrade their tiff packages to version 4.0.2-6+deb7u19 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
The impact of this vulnerability is limited to a denial of service, as it causes the application to crash. However, it is important to note that this vulnerability can be exploited remotely.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
No, there is no known workaround for this vulnerability. It is recommended to upgrade the tiff package to the latest version to address the issue.
There are no known exploits for this vulnerability at the moment. However, it is advisable to apply the security update as soon as possible to mitigate the risk.
You can find more information about this vulnerability in the Debian LTS security advisory DLA-1346-1 at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
