Missing Release of Resource after Effective Lifetime

Affecting tiff package, versions <0.0.0

Overview

** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.

References

• ADVISORY
• CVE Details
• Debian Security Tracker
• MISC
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Seclists Full Disclosure
• Seclists Full Disclosure
• Security Focus