Описание
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| tiff | fixed | 4.5.0-2 | package | |
| tiff | no-dsa | bullseye | package | |
| tiff | ignored | buster | package |
Примечания
https://gitlab.com/libtiff/libtiff/-/issues/455
https://gitlab.com/libtiff/libtiff/-/merge_requests/386
https://gitlab.com/libtiff/libtiff/-/commit/d093eb5d961e21ba51420bc22382c514683a4d91 (v4.5.0rc1)
The specific PoC starts triggering with https://gitlab.com/libtiff/libtiff/-/commit/7db4f2b62206b9cba6cda538e0f296df0ac371bd (v4.4.0)
but the patch mentions this is an older, more general issue, requiring prior incomplete fix from:
https://gitlab.com/libtiff/libtiff/-/commit/f01c22704826d1587fb8d91b253752b13c6713ba (v4.0.10)
so let's assume versions < v4.4.0 are vulnerable.
EPSS
Связанные уязвимости
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
Уязвимость функции TIFFReadDirectory библиотеки LibTIFF, позволяющая нарушителю вызвать отказ в обслуживании
EPSS