NULL Pointer Dereference in Libtiff's TIFF File Processing
CVE-2023-2731

5.5MEDIUM

Key Information:

Vendor

Libtiff

Status
Libtiff
Vendor
CVE Published:
17 May 2023

What is CVE-2023-2731?

A notable NULL pointer dereference flaw exists in the LZWDecode() function of the Libtiff library, specifically in the libtiff/tif_lzw.c file. This vulnerability can be exploited by local attackers who create specially crafted input data that causes the program to dereference a NULL pointer during the decompression of TIFF files. This results in a program crash or potential denial of service, impacting the availability and reliability of applications utilizing this library.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

libtiff Fixed in libtiff v4.5.0

References

https://gitlab.com/libtiff/libtiff/-/issues/548
https://bugzilla.redhat.com/show_bug.cgi?id=2207635
https://github.com/libsdl-org/libtiff/commit/9be22b639ea6...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.