Executive brief
libtiff is a widely used library for reading and writing Tagged Image File Format (TIFF) files. A vulnerability in this library allows a remote attacker to provide a specially crafted image file that can crash applications using the library or potentially expose sensitive information from the system's memory. This could lead to service disruptions or unauthorized data access in any software that processes untrusted TIFF images.
Technical details
An out-of-bounds read vulnerability exists in libtiff's tif_read.c within the TIFFReadRawStrip1() and TIFFReadRawTile1() functions. The flaw is triggered when a TIFF file contains a 'stripoffset' value that exceeds the maximum value of the tmsize_t type, leading to a negative index in a file-content buffer. A remote attacker can exploit this by providing a malicious TIFF image to an application using the library. Successful exploitation can result in a process crash (Denial of Service) due to accessing unmapped memory or the disclosure of sensitive information from the process heap. The issue was addressed in libtiff version 4.0.7.
Affected products
- libtiff libtiff before 4.0.7
Timeline
- 2016-07-10: patched: Fixed in CVS HEAD revision 1.49
- 2016-07-14: disclosed: CVE assigned via oss-security mailing list
- 2017-01-13: advisory: Debian Security Advisory DSA-3762-1 released
- 2017-01-23: advisory: NVD publication date