CVE-2023-2731: NULL Pointer Dereference

May 17, 2023 (updated July 3, 2023)

A NULL pointer dereference flaw was found in Libtiff’s LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.

References

access.redhat.com/security/cve/CVE-2023-2731
bugzilla.redhat.com/show_bug.cgi?id=2207635
github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527b
gitlab.com/libtiff/libtiff/-/issues/548
nvd.nist.gov/vuln/detail/CVE-2023-2731

Code Behaviors & Features

Detect and mitigate CVE-2023-2731 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →