Heap-based Buffer Overflow in tiff2pdf utility of tiff3
Summary
DLA-1094-1: tiff3 - security update. Affects tiff3 versions < 3.9.6-11+deb7u8. Fixed in 3.9.6-11+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tiff3 package is a part of the Tag Image File Format (TIFF) library. It provides utilities for manipulating TIFF image files. The tiff2pdf utility, included in the package, is used to convert TIFF images to PDF format. This vulnerability affects the tiff2pdf utility specifically.
Vulnerability Detail
A heap-based buffer overflow vulnerability has been discovered in the tiff2pdf utility of the tiff3 package. This vulnerability occurs when processing a PlanarConfig=Contig image, which can trigger an out-of-bounds write in the ZIPDecode function. An attacker can exploit this vulnerability by providing a crafted input, potentially leading to a remote denial of service attack or arbitrary code execution.
How To Fix
Minimum fixed version
3.9.6-11+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiff3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, a heap-based buffer overflow vulnerability has been discovered in the tiff2pdf utility of the tiff3 package. It is crucial to upgrade to version 3.9.6-11+deb7u8 or later to mitigate the risk of remote code execution or denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff3 →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service on systems using the tiff2pdf utility.
No specific workaround has been provided for this vulnerability. It is recommended to apply the available security update.
The vulnerability affects tiff3 package versions prior to 3.9.6-11+deb7u8.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
You can use Vulert's playground at https://vulert.com/scanner to check if your application or system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for tiff3.
