CVE-2020-35522: Buffer Overflow
A flaw was found in libtiff 4.1.0 and before. Due to a memory allocation failure in tifread.c, a crafted TIFF file can lead to an abort, resulting in denial of service.
This is a different flaw from CVE-2020-35521
References:
https://gitlab.com/libtiff/libtiff/-/mergerequests/165 https://gitlab.com/libtiff/libtiff/-/commit/98a254f5b92cea22f5436555ff7fceb12afee84d
Other sources
In LibTIFF, there is a memory malloc failure in tifpixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
— MITRE
libtiff is vulnerable to a denial of service, caused by a memory malloc failure in tifpixarlog.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35522?
CVE-2020-35522 is classified as a denial of service vulnerability due to a memory allocation failure.
How do I fix CVE-2020-35522?
To fix CVE-2020-35522, upgrade the libtiff package to version 4.2.0 or apply the recommended patches for affected software.
Which software is affected by CVE-2020-35522?
CVE-2020-35522 affects libtiff versions prior to 4.2.0 and several versions of IBM Cognos Analytics.
Is CVE-2020-35522 a remote attack vulnerability?
CVE-2020-35522 can potentially be exploited remotely through crafted TIFF files to cause denial of service.
What systems are at risk with CVE-2020-35522?
Systems running vulnerable versions of libtiff, Red Hat Enterprise Linux, or IBM Cognos Analytics are at risk for CVE-2020-35522.