Executive brief
LibTIFF is a widely used library for processing TIFF image files. A vulnerability in its image conversion tools allows an attacker to crash applications or potentially execute malicious code if a user is tricked into processing a specially crafted BMP image. This could lead to a complete system compromise or a disruption of services that handle image uploads.
Technical details
A heap-based buffer over-read exists in the LZWEncode function within tif_lzw.c of LibTIFF 4.0.7. The vulnerability is triggered when the bmp2tiff utility processes a specially crafted BMP image using LZW compression. An attacker can exploit this by providing a malformed BMP file that causes the encoder to read beyond the allocated memory buffer. This can result in an application crash (DoS) or, in some scenarios, the execution of arbitrary code. While the bmp2tiff tool was later removed from the upstream project to mitigate the issue, users of version 4.0.7 should upgrade to version 4.0.8 or apply vendor-specific patches.
Affected products
- LibTIFF LibTIFF 4.0.7
Timeline
- 2017-01-18: disclosed: Bug reported to LibTIFF Bugzilla
- 2017-01-23: advisory: NVD published CVE-2017-5563
- 2017-04-27: other: Upstream marked as WONTFIX after removing the affected bmp2tiff tool
- 2017-09-26: patched: Gentoo released fixed version 4.0.8