Memory leaks in tiff package
Summary
DLA-984-1: tiff - security update. Affects tiff versions < 4.0.2-6+deb7u14. Fixed in 4.0.2-6+deb7u14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tiff package is a software library and set of tools for reading, writing, and manipulating TIFF (Tagged Image File Format) image files. It provides support for various compression schemes and color spaces. The package is widely used in applications that deal with image processing and manipulation. However, it was found that the tiff package was affected by multiple memory leaks, which could lead to denial of service attacks.
Vulnerability Detail
The tiff package suffered from two memory leaks vulnerabilities, namely CVE-2017-9403 and CVE-2017-9404. These vulnerabilities could be exploited by an attacker to cause a denial of service by consuming excessive memory resources. Additionally, the package had previously patched vulnerabilities related to _TIFFVGetField issues (CVE-2016-10095, CVE-2017-9147). The Debian-specific patches were replaced with upstream provided patches to align with the upstream codebase.
How To Fix
Minimum fixed version
4.0.2-6+deb7u14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The tiff package was found to have memory leaks vulnerabilities that could lead to denial of service attacks. Upgrading to version 4.0.2-6+deb7u14 or later is recommended to fix these vulnerabilities. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
The tiff package is a software library and set of tools for reading, writing, and manipulating TIFF image files.
The memory leaks vulnerabilities in the tiff package could be exploited by an attacker to cause a denial of service by consuming excessive memory resources.
To fix the vulnerabilities, you should upgrade the tiff package to version 4.0.2-6+deb7u14 or later.
No specific workarounds have been provided for these vulnerabilities. It is recommended to upgrade to the fixed version.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
