Junglewise Threat Intelligence

CVE-2016-9448: LibTiff NULL pointer dereference in TIFFFetchNormalTag

CVE-2016-9448 · Severity: high · CVSS 7.5 · Published 2017-01-27

Technologies: Opensuse, LibTiff Project Libtiff. Vendors: Opensuse, Libtiff.

Executive brief

LibTiff is a widely used library for reading and writing Tag Image File Format (TIFF) files, often utilized by image viewers and document processing software. A vulnerability in this library allows a remote attacker to crash applications that process specially crafted TIFF images. This results in a denial-of-service condition, potentially disrupting business operations or services that handle automated image processing.

Technical details

A NULL pointer dereference exists in the TIFFFetchNormalTag function within tif_dirread.c of LibTiff 4.0.6. The vulnerability is triggered when the library processes TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tags that point to 0-byte arrays, leading to an invalid memory access and subsequent process crash. This issue stemmed from an incomplete fix for a previous vulnerability (CVE-2016-9297). An attacker can exploit this by providing a malicious TIFF file to any application linked against the vulnerable library. The issue was resolved in LibTiff version 4.0.7 and various downstream Linux distribution patches.

Affected products

  • LibTiff Project LibTiff 4.0.6

Timeline

  • 2016-11-16: disclosed: Bug reported to LibTiff Bugzilla (Bug 2593)
  • 2016-11-16: patched: Fix committed to LibTiff CVS repository
  • 2016-11-18: other: CVE-2016-9448 assigned
  • 2017-01-27: advisory: NVD advisory published

References

Related threats