Fluid Attacks Database

Description

Golang TIFF decoder vulnerable to excessive CPU consumption A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	golang-golang-x-image	>=0 <0.11.0-1	0.11.0-1
go	golang.org/x/image	>=0 <0.10.0	0.10.0
go	cs.opensource.google/go/x/net	>=0 <0.10.0	0.10.0
debian 11	golang-golang-x-image	=0.0~git20200119.58c2397-1 \|\| =0.0~git20210628.a66eb64-1 \|\| =0.0~git20211028.6944b10-1 \|\| =0.0~git20211028.6944b10-1~bpo11+1 \|\| =0.1.0-1 \|\| =0.11.0-1 \|\| =0.12.0-1 \|\| =0.13.0-1 \|\| =0.14.0-1 \|\| =0.15.0-1 \|\| =0.16.0-1 \|\| =0.18.0-1 \|\| =0.2.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.5.0-1 \|\| =0.7.0-1 \|\| =0.8.0-1 \|\| =0.9.0-1	-
debian 12	golang-golang-x-image	=0.11.0-1 \|\| =0.12.0-1 \|\| =0.13.0-1 \|\| =0.14.0-1 \|\| =0.15.0-1 \|\| =0.16.0-1 \|\| =0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.5.0-1 \|\| =0.7.0-1 \|\| =0.8.0-1 \|\| =0.9.0-1	-
debian 13	golang-golang-x-image	>=0 <0.11.0-1	0.11.0-1

Aliases

1. CVE-2023-294072. NVD-2023-294073. OSV-DEBIAN-2023-294074. OSV-2023-294075. GCVE-2023-294076. SECURITY-TRACKER-CVE-2023-29407

References

1. https://go.dev/cl/5148972. https://go.dev/issue/615813. https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K64. https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ25. https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK6. https://pkg.go.dev/vuln/GO-2023-19907. https://security.netapp.com/advisory/ntap-20230831-0009