Critical Buffer Overflow and OOM Vulnerabilities in libtiff Package
Summary
ALSA-2026:41892: Important: libtiff security, bug fix, and enhancement update. Affects libtiff versions < 4.6.0-8.el10_2.4. Fixed in 4.6.0-8.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff package is a widely used library for manipulating Tagged Image File Format (TIFF) files, which are commonly used for storing images. This library provides essential functions for reading and writing TIFF files, making it integral to many applications that handle image processing. However, recent vulnerabilities have been identified that could compromise the security and stability of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libtiff include a heap-based buffer overflow and an out-of-memory (OOM) condition. The buffer overflow can occur when processing a specially crafted PixarLog-compressed TIFF image, potentially allowing an attacker to execute arbitrary code. The OOM issue arises from the TIFFRasterScanlineSize64 function producing excessively large sizes, which can lead to resource exhaustion and application crashes. These vulnerabilities can severely impact the integrity and availability of systems using the affected versions of libtiff.
How To Fix
Minimum fixed version
4.6.0-8.el10_2.4
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing TIFF files that are suspected to be crafted or untrusted until the package is updated. Additionally, implementing strict input validation for TIFF files can help mitigate the risk of exploitation.
Conclusion
The identified vulnerabilities in the libtiff package pose significant risks to applications that utilize this library for image processing. Users are strongly advised to update to the latest patched version to safeguard their systems against potential exploits. Regular monitoring and updates are essential for maintaining software security.
See every vulnerability recorded for libtiff →
FAQ
libtiff is a library for reading and writing TIFF (Tagged Image File Format) files, widely used in image processing applications.
The vulnerabilities can lead to arbitrary code execution and application crashes, compromising system security and stability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application's manifest file at Vulert Scanner to see if it is affected.
Yes, avoid processing untrusted TIFF files and implement strict input validation as a temporary measure.
It is recommended to regularly check for updates and apply them promptly to ensure your software is secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
