Executive brief
A vulnerability exists in libtiff, a widely used library for processing TIFF image files. An attacker can provide a specially crafted image that, when opened by an application using this library, causes the application to crash. This results in a denial of service, potentially disrupting business operations or software that relies on image processing.
Technical details
A memory corruption vulnerability exists in libtiff versions 4.0.6 and earlier within the DumpModeDecode function. The flaw is categorized as an improper restriction of operations within the bounds of a memory buffer (CWE-119), leading to an invalid memory read. An unauthenticated remote attacker can exploit this by enticing a user or automated system to process a maliciously crafted TIFF image. Successful exploitation results in an application crash (denial of service). The issue is addressed in libtiff version 4.0.7.
Affected products
- LibTIFF libtiff 4.0.6 and earlier
Timeline
- 2017-01-09: patched: Gentoo and Debian released updates addressing the issue in libtiff 4.0.7.
- 2017-01-20: disclosed: NVD publication date.