A denial of service flaw was found in the way libtiff parsed certain tiff files. An attacker could use this flaw to create a specially crafted TIFF file that would cause an application using libtiff to exhaust all available memory on the system.

Original report:

http://seclists.org/oss-sec/2015/q3/601

The pal2rgb tool (tools/pal2rgb.c) in LibTIFF 4.0.9 is vulnerable to a heap-based bufferflow when parsing a specially crafted .tif file. A remote attacker could exploit this to cause an application crash (denial of service) or other possible unspecified impact.

References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17095 http://www.openwall.com/lists/oss-security/2017/11/30/3 http://www.cvedetails.com/cve/CVE-2017-17095/ http://bugzilla.maptools.org/showbug.cgi?id=2750

An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.

A heap-buffer-overflow flaw was found in TIFFReadRawDataStriped() function in tiffinfo.c.

References: https://gitlab.com/libtiff/libtiff/-/issues/319 https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798

An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.

Upstream issue:

http://bugzilla.maptools.org/showbug.cgi?id=2807

Upstream patch:

https://gitlab.com/libtiff/libtiff/mergerequests/33/diffs?commitid=f1b94e8a3ba49febdd3361c0214a1d1149251577

A null pointer dereference issue was found in Libtiff's tifdirinfo.c file. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or just injecting faults, which would cause segmentation fault. This may cause an application crash, eventually leading to a denial of service.

References: https://gitlab.com/libtiff/libtiff/-/mergerequests/559 https://gitlab.com/libtiff/libtiff/-/issues/624

An issue was found in the tiffcp utility distributed by the libtiff package. Processing a crafted TIFF file may cause a heap-based buffer overflow, resulting in an application crash.

Reference: https://gitlab.com/libtiff/libtiff/-/issues/606

TIFFClientOpen in tifunix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff.

A flaw was found in the libtiff library. An out-of-memory issue in the TIFFReadEncodedStrip function can be triggered when processing a crafted tiff file, allowing attackers to perform memory allocation of arbitrary sizes, resulting in a denial of service.

Reference: https://gitlab.com/libtiff/libtiff/-/issues/620

Upstream patch: https://gitlab.com/libtiff/libtiff/-/mergerequests/553

ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpegfdct16x16 in jfdctint.c.

A flaw was found in in LibTIFF 4.0.9. ChopUpSingleUncompressedStrip in tifdirread.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted TIFF file, as demonstrated by tiff2pdf.

References: http://bugzilla.maptools.org/showbug.cgi?id=2808

libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.

https://gitlab.com/libtiff/libtiff/-/issues/520 https://gitlab.com/libtiff/libtiff/-/mergerequests/467

The TIFFFetchShortPair function in tifdirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.

Drew Yao of Apple Product Security reported a flaw in the LZW decoder used by libtiff to handle LZW-encoded images. Translation table used by decoding algorithm is not properly re-initialized after "code clear" code is read from the stream being decoded. When reading that code, decoder should discard previous translation table and start filling it again.

Later during the processing, no longer valid table entries may be indexed by the input stream, causing libtiff to follow no longer valid pointer. This can result in crash, memory corruption and possibly allow code execution.

References: http://www.remotesensing.org/libtiff/ http://en.wikipedia.org/wiki/Lzw

Acknowledgements:

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

Heap-based buffer overflow in tifojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvtwholeimage function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.

The OJPEGPostDecode function in tifojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."

The TIFFVStripSize function in tifstrip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error.

LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.

The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."

The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values.

LibTIFF 3.9.4 and earlier does not properly handle an invalid tdstripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted TIFF file, a different vulnerability than CVE-2010-2443.

The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2443 to the following vulnerability:

Unspecified vulnerability in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) via an OJPEG image with undefined strip offsets.

References: http://www.remotesensing.org/libtiff/v3.9.3.html

A flaw was found in a way libtiff handled vertically flipped (i.e. with negative toskew) images on 64bit platforms. Numeric computation used to calculate buffer pointer was done in the way that incorrectly extended from 32bit type to 64bit, resulting in out-of-bounds writes.

For more details, refer to following bugs: http://bugzilla.maptools.org/showbug.cgi?id=2207 https://bugzilla.redhat.com/showbug.cgi?id=583081

Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.

iDefense reported to us a libtiff flaw discovered by Dan Rosenberg. Quoting description from iDefense advisory draft:

Remote exploitation of a stack buffer overflow vulnerability in version 3.9.2 of LibTIFF, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code with the privileges of the current user.

...

This vulnerability is due to insufficient bounds checking when copying data into a stack allocated buffer. During the processing of a certain EXIF tag a fixed sized stack buffer is used as a destination location for a memory copy. This memory copy can cause the bounds of a stack buffer to be overflown and this condition may lead to arbitrary code execution.

A flaw was reported in libtiff's thunder decoder. The thunder decoder assumes 4bits per pixel, but if a file has bitpersample set to a smaller value, or defaulted (1) then the allocated strip buffer will be too small, and a heap-based buffer overlow may occur. This could be used to crash an application linked to libtiff, or execute arbitrary code with the privileges of the application opening a malicious TIFF file.