CVE-2024-13978

What it actually does

Null pointer dereference in t2p_read_tiff_init within tiff2pdf.c when processing malformed TIFF input, resulting in local process crash.

Why it matters to the business

Limited operational risk of denial-of-service crashes when users or scripts locally convert untrusted TIFF images with the affected tools; low prevalence and high attack complexity reduce likelihood of widespread impact.

How an attack unfolds

An attacker with local access supplies a specially crafted TIFF file to the tiff2pdf or fax2ps utilities; the malformed data reaches t2p_read_tiff_init and triggers a null pointer access that crashes the process, though reliable exploitation requires high skill and specific conditions.

How to fix it

Update LibTIFF to the commit 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4 or later; rebuild any dependent packages that ship the affected tiff2pdf/fax2ps binaries.

How to confirm the fix worked

Confirm the installed LibTIFF version or source tree contains commit 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4; re-run conversion of known problematic TIFF samples and verify absence of crashes.

Typical attack path

1. Obtain local access to a system with vulnerable LibTIFF tools
2. Craft a TIFF file that triggers the null dereference in t2p_read_tiff_init
3. Invoke tiff2pdf or fax2ps against the malicious file
4. Observe resulting process crash or denial of service

How to detect it

Review local process crash logs or core dumps referencing tiff2pdf or fax2ps for signs of null dereference; correlate with user execution of image conversion utilities on untrusted files.

What your security team should do

• Apply the referenced commit or newer LibTIFF release across all build pipelines and distributions
• Inventory systems that ship or depend on tiff2pdf/fax2ps and schedule updates
• Monitor for any future EPSS increase or public exploit code despite currently low scores