LibTIFF Null Pointer Dereference Vulnerability in Fax2ps Utility

A null pointer dereference vulnerability exists in the LibTIFF library, specifically in version 4.7.0 and prior. The issue is present in the 'fax2ps' utility, within the 't2p_read_tiff_init' function of 'tools/tiff2pdf.c'. This vulnerability arises when the utility processes a malformed TIFF file, leading to a segmentation fault and application crash. The problem occurs if the TIFFTAG_FAXFILLFUNC mechanism is active, causing the utility to write to a null output buffer.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a crash of the 'fax2ps' application.

Reproduction

The vulnerability can be reproduced by using a malformed TIFF file with the 'fax2ps' tool. After compiling LibTIFF with AddressSanitizer enabled, the 'fax2ps' command can be run with the malformed file as input. This will trigger the null pointer dereference, causing a segmentation fault.

Remediation

Users are advised to update to the latest version of LibTIFF, where this vulnerability has been fixed.