DSA-4349: -1 tiff -- security update
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Who is exposed to these vulnerabilities?
Systems using the libtiff library or its included tools are exposed when they process malformed TIFF image files. This includes workflows that open, convert, inspect, or otherwise parse untrusted TIFF content.
What does an attacker need to exploit the issue?
An attacker needs to cause a vulnerable libtiff consumer or included tool to process a malformed image file. The stated outcomes are denial of service or arbitrary code execution.
How can I tell whether my environment may be affected?
Identify Debian systems with the tiff package installed and determine whether applications or operational tools process TIFF files, particularly files from untrusted sources. The advisory references CVE-2017-11613, CVE-2017-17095, and CVE-2018-5784.