CVE-2023-3576: Missing Release of Memory after Effective Lifetime

October 4, 2023 (updated November 7, 2023)

A memory leak flaw was found in Libtiff’s tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.

References

access.redhat.com/security/cve/CVE-2023-3576
bugzilla.redhat.com/show_bug.cgi?id=2219340
nvd.nist.gov/vuln/detail/CVE-2023-3576

Code Behaviors & Features

Detect and mitigate CVE-2023-3576 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →