CVE-2020-35521: Buffer Overflow
A flaw was found in libtiff 4.1.0 and before. Due to a memory allocation failure in tifread.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
References:
https://gitlab.com/libtiff/libtiff/-/mergerequests/165 https://gitlab.com/libtiff/libtiff/-/commit/b5a935d96b21cda0f434230cdf8ca958cd8b4eef
Other sources
A flaw was found in libtiff. Due to a memory allocation failure in tifread.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
— MITRE
libtiff is vulnerable to a denial of service, caused by a memory malloc failure in tifread.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35521?
CVE-2020-35521 is classified as a denial of service vulnerability due to a memory allocation failure.
How do I fix CVE-2020-35521?
To mitigate CVE-2020-35521, upgrade libtiff to version 4.2.0 or apply the relevant patches for affected software.
Which software is affected by CVE-2020-35521?
CVE-2020-35521 affects libtiff versions 4.1.0 and prior, as well as specific versions of IBM Cognos Analytics.
Can CVE-2020-35521 be exploited remotely?
Yes, CVE-2020-35521 can be exploited through a crafted TIFF file leading to a denial of service.
Is there any known exploit for CVE-2020-35521?
There are no specific publicly known exploits for CVE-2020-35521 as of yet, but the vulnerability poses a risk of service interruption.