REDHAT-BUG-2064406: Medium severity tiff vulnerability

Published Mar 15, 2022

Updated

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources.

Upstream fix: https://gitlab.com/libtiff/libtiff/-/mergerequests/306

Affected Software

1 affected component

LibTIFF libtiff

Event History

Mar 15, 2022

Data Sourced

via Red Hat·06:37 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is most likely to be exposed to this issue?

The issue is specifically identified for users who compile libtiff from source. Environments that process untrusted TIFF files with the tiffcp utility are the relevant exposure scenario.

What does an attacker need to exploit it?

An attacker needs to provide a crafted TIFF file that is processed by tiffcp. Successful exploitation can cause a denial of service through a reachable assertion.

Is there an upstream fix available?

Yes. The provided upstream merge request 306 contains the referenced fix.

REDHAT-BUG-2064406: Medium severity tiff vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is most likely to be exposed to this issue?

What does an attacker need to exploit it?

Is there an upstream fix available?

Company

Resources

Contact

Frequently Asked Questions

Who is most likely to be exposed to this issue?

What does an attacker need to exploit it?

Is there an upstream fix available?