REDHAT-BUG-1631078: Low severity tiff vulnerability

Published Sep 19, 2018

Updated

An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.

Upstream issue:

http://bugzilla.maptools.org/showbug.cgi?id=2807

Upstream patch:

https://gitlab.com/libtiff/libtiff/mergerequests/33/diffs?commitid=f1b94e8a3ba49febdd3361c0214a1d1149251577

Affected Software

1 affected component

LibTIFF libtiff

Event History

Sep 19, 2018

Data Sourced

via Red Hat·08:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1631078?

The severity of REDHAT-BUG-1631078 is considered critical due to the potential for denial of service and application crashes.

How do I fix REDHAT-BUG-1631078?

To fix REDHAT-BUG-1631078, update to the latest version of LibTIFF that addresses the out-of-bounds writes.

What systems are affected by REDHAT-BUG-1631078?

REDHAT-BUG-1631078 affects versions of LibTIFF prior to the latest release that resolves the identified vulnerabilities.

What type of vulnerabilities are present in REDHAT-BUG-1631078?

REDHAT-BUG-1631078 involves out-of-bounds write vulnerabilities that can lead to application crashes.

Can REDHAT-BUG-1631078 lead to data breaches?

While REDHAT-BUG-1631078 is primarily a denial of service issue, it may potentially lead to data exposure depending on the crafted image file used.