Critical UNKNOWN READ Vulnerability in libvips - Affects TIFF Handling
Summary
OSV-2024-1406: UNKNOWN READ in _TIFFVSetField. Affects libvips versions >= 1ad652636bf80190860afde5f4a0365f71dd0301, < 0c9c7b16fe8ed35237c8994c13ead654f94ed860. Fixed in 0c9c7b16fe8ed35237c8994c13ead654f94ed860. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libvips is an open-source image processing library that is designed for high-performance image manipulation. It is widely used for tasks such as resizing, cropping, and format conversion. The library is known for its speed and efficiency, making it a popular choice for developers working with large images. However, it has been found to have a vulnerability related to its handling of TIFF files, which can lead to potential crashes and data exposure.
Vulnerability Detail
The vulnerability identified as OSV-2024-1406 is an UNKNOWN READ issue occurring in the _TIFFVSetField function. This vulnerability can lead to crashes when the library attempts to process certain TIFF files, potentially allowing an attacker to exploit this behavior. The crash state involves functions such as TIFFSetField and TIFFFetchNormalTag, which are critical for handling TIFF metadata. The origin of this vulnerability is linked to improper handling of memory, which can result in unexpected behavior during image processing.
How To Fix
Minimum fixed version
0c9c7b16fe8ed35237c8994c13ead654f94ed860
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted TIFF files until the library has been updated. Additionally, you can implement input validation to ensure that only safe and trusted image files are processed by your application.
Conclusion
The UNKNOWN READ vulnerability in libvips poses a significant risk to applications that process TIFF files. It is crucial to update to the patched version to mitigate potential crashes and ensure the integrity of your image processing workflows. By following the recommended steps and utilizing tools like Vulert, developers can maintain a secure environment.
See every vulnerability recorded for libvips →
FAQ
The impact includes potential crashes of applications using libvips when processing certain TIFF files, which could lead to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While the primary risk is application crashes, improper handling of TIFF files could potentially lead to data exposure in certain scenarios.
If immediate updates are not possible, implement input validation and avoid processing untrusted TIFF files as a temporary measure.
More information can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=385406655.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvips.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
