Vulnerabilities

Hackers Can Target LEADTOOLS Users With Malicious Image Files

Cisco Talos security researchers have discovered multiple vulnerabilities in the LEADTOOLS imaging toolkits that could lead to code execution on the victim system.

Ionut Arghire

November 8, 2019

Cisco Talos security researchers have discovered multiple vulnerabilities in the LEADTOOLS imaging toolkits that could lead to code execution on the victim system.

Developed by LEAD Technologies Inc., LEADTOOLS represents a collection of toolkits for integrating document, medical, multimedia and imaging technologies into applications tailored for desktop, server, and mobile devices. An SDK and various libraries provide support for multiple operating systems.

According to Talos researchers, multiple vulnerabilities discovered in LEADTOOLS could allow a malicious actor to cause denial-of-service (DoS) conditions and even execute code remotely on an affected system.

The first of these bugs is a heap out-of-bounds write vulnerability in the TIF-parsing functionality of LEADTOOLS 20. Tracked as CVE-2019-5084, the vulnerability can be exploited with the help of a specially crafted TIF image to cause an offset beyond the bounds of a heap allocation to be written.

The CMP-parsing functionality of LEADTOOLS 20, Talos reports, is impacted by an integer underflow security flaw. Tracked as CVE-2019-5099, the issue can be exploited using a specially crafted CMP image file.

Cisco’s researchers also discovered that the BMP header parsing functionality of LEADTOOLS 20 is impacted by an integer overflow bug (tracked as CVE-2019-5100), and that the JPEG2000-parsing functionality of LEADTOOLS 20 has an exploitable heap overflow vulnerability (CVE-2019-5125).

The same as with the first two bugs, an attacker looking to trigger these weaknesses would need specially crafted BMP and J2K image files.

All four vulnerabilities are rated High severity and have a CVSS score of 8.8.

Talos’ security researchers found these bugs in LEADTOOLS 20.0.2019.3.15 in early September and reported them to the vendor on September 10. A patch was released earlier this week.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George