Vulnerability in tiff3 package - NULL Pointer Dereference in TIFFPrintDirectory function
Summary
DLA-1347-1: tiff3 - security update. Affects tiff3 versions < 3.9.6-11+deb7u10. Fixed in 3.9.6-11+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tiff3 package is a software library and set of tools for reading, writing, and manipulating TIFF (Tagged Image File Format) files. It provides functionality for various image-related operations. The vulnerability in the package arises from a NULL Pointer Dereference in the TIFFPrintDirectory function, specifically when using the tiffinfo tool to print crafted TIFF information. This vulnerability can be exploited remotely, leading to a crash of the application.
Vulnerability Detail
The vulnerability in the tiff3 package is a result of a NULL Pointer Dereference in the TIFFPrintDirectory function. When the tiffinfo tool is used to print manipulated TIFF information, remote attackers can exploit this vulnerability to cause the application to crash. The impact of this vulnerability is limited to a denial of service, as it does not allow for arbitrary code execution or privilege escalation. However, it can disrupt the normal operation of the affected application.
How To Fix
Minimum fixed version
3.9.6-11+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiff3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the tiffinfo tool is not used to print untrusted or manipulated TIFF files.
Conclusion
The tiff3 package is vulnerable to a NULL Pointer Dereference in the TIFFPrintDirectory function when using the tiffinfo tool to print manipulated TIFF information. This vulnerability can be exploited remotely to cause a crash of the application. To mitigate the risk, it is recommended to upgrade to the fixed version of the tiff3 package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tiff3 →
FAQ
The vulnerability can lead to a crash of the application, resulting in a denial of service. However, it does not allow for arbitrary code execution or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There is no known exploit available for this vulnerability at the time of this advisory.
Apart from upgrading to the fixed version of the tiff3 package, users can mitigate the risk by avoiding the use of the tiffinfo tool to print untrusted or manipulated TIFF files.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for tiff3.
