Memory Leak Affecting libtiff package, versions [,4.0.7]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.28% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-LIBTIFF-2327427
  • published29 Dec 2021
  • disclosed22 Jun 2017
  • creditUnknown

Introduced: 22 Jun 2017

CVE-2017-9815  (opens in a new tab)
CWE-772  (opens in a new tab)

How to fix?

There is no fixed version for libtiff.

Overview

Affected versions of this package are vulnerable to Memory Leak. In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file.

CVSS Scores

version 3.1