PT-2023-17076 · Tinytiff · Tinytiff

10Cksyiqiyinhangzhoutechnology · CVE-2023-1560 · Published 2023-03-22 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions TinyTIFF version 3.0.0.0

Description A problematic issue has been found in the File Handler component, specifically in the tinytiffreader.c file, leading to a buffer overflow. This issue requires local attacking to be exploited. The exploit has been disclosed to the public and may be used.

Recommendations For TinyTIFF version 3.0.0.0, as a temporary workaround, consider restricting access to the tinytiffreader.c file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-1560

Affected Products

Tinytiff

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1560.json · Exploit
• 🔥 https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF/blob/main/id8 · Exploit
• 🔥 https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF · Exploit
• https://osv.dev/vulnerability/CVE-2023-1560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1560 · Security Note
• https://vuldb.com/?id.223553 · Note
• https://vuldb.com/?ctiid.223553 · Note
• https://t.me/cibsecurity/60446 · Telegram Post
• https://t.me/cvenotify/46737 · Telegram Post