Executive brief
libtiff is a widely used library for processing Tag Image File Format (TIFF) images. A vulnerability in the library's thumbnail processing component allows a remote attacker to crash applications that use libtiff by providing a specially crafted image file. This could lead to a denial-of-service condition for any software, such as image viewers or web browsers, that relies on this library to handle TIFF files.
Technical details
A stack-based buffer overflow exists in libtiff's _TIFFVGetField function within tif_dir.c. The vulnerability is triggered when the thumbnail utility or other library consumers process a maliciously crafted TIFF file containing specific tags (e.g., tag 327). An attacker can exploit this by enticing a user to open a crafted image, leading to an out-of-bounds write. While primarily identified as a denial-of-service (crash) vector, memory corruption on the stack can theoretically lead to arbitrary code execution under specific conditions. The issue was addressed in libtiff version 4.0.7.
Affected products
- libtiff libtiff 4.0.6 and earlier
Timeline
- 2016-04-27: disclosed: Vulnerability details shared on oss-security mailing list
- 2017-01-09: patched: Gentoo released GLSA 201701-16 referencing the fix in 4.0.7
- 2017-01-20: advisory: NVD published CVE-2016-5318 details