Vulnerability in libtiff - Regression Update
Summary
DLA-693-2: tiff - regression update. Affects tiff versions < 4.0.2-6+deb7u10. Fixed in 4.0.2-6+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff library and associated tools provided in libtiff-tools are vulnerable to multiple security problems. This update addresses several memory corruption issues in various tools, including bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, ycbcr, rgb2ycbcr, and thumbnail. Additionally, it fixes buffer overflows triggered through TIFFGetField() on unknown tags, a heap-based buffer overflow in tiff2pdf, and an information leak in libtiff/tif_read.c.
Vulnerability Detail
The vulnerability in libtiff allows for various types of memory corruption, buffer overflows, and information leaks. These issues can be exploited by an attacker to execute arbitrary code, cause a denial of service, or leak sensitive information. The vulnerabilities primarily affect the deprecated tools bmp2tiff, gif2tiff, rgb2ycbcr, and thumbnail. The buffer overflows in TIFFGetField() can be triggered by unknown tags, while the heap-based buffer overflow in tiff2pdf can be exploited through specially crafted TIFF files. The information leak in libtiff/tif_read.c allows for out-of-bounds reads on memory-mapped files.
How To Fix
Minimum fixed version
4.0.2-6+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the provided fix by upgrading the tiff package to the recommended version.
Conclusion
The vulnerability in libtiff and associated tools poses a significant security risk, allowing for memory corruption, buffer overflows, and information leaks. It is crucial to upgrade the tiff package to the recommended version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
The vulnerability allows an attacker to execute arbitrary code, cause a denial of service, or leak sensitive information.
The vulnerable tools include bmp2tiff, gif2tiff, rgb2ycbcr, and thumbnail.
No, there are no known workarounds. It is crucial to apply the provided fix by upgrading the tiff package.
You can upgrade the tiff package using the appropriate package manager or by manually downloading and installing the updated package from the official Debian repository.
You can find more information about this vulnerability in the Debian LTS security advisories and the provided CVE links.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
