CVE-2023-2908: NULL Pointer Dereference

June 30, 2023 (updated November 7, 2023)

A null pointer dereference issue was discovered in Libtiff’s tif_dir.c file. This flaw allows an attacker to pass a crafted TIFF image file to the tiffcp utility, which triggers runtime error, causing an undefined behavior, resulting in an application crash, eventually leading to a denial of service.

References

access.redhat.com/security/cve/CVE-2023-2908
bugzilla.redhat.com/show_bug.cgi?id=2218830
gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
gitlab.com/libtiff/libtiff/-/merge_requests/479
nvd.nist.gov/vuln/detail/CVE-2023-2908

Code Behaviors & Features

Detect and mitigate CVE-2023-2908 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →