CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Libtiff : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-4244 119 DoS Exec Code Overflow 2013-09-28 2014-03-05
6.8
None Remote Medium Not required Partial Partial Partial
The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.
2 CVE-2013-4243 119 DoS Exec Code Overflow 2013-09-10 2014-03-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image.
3 CVE-2013-4232 399 DoS Exec Code 2013-09-10 2014-03-05
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted TIFF image.
4 CVE-2013-4231 119 DoS Overflow 2014-01-19 2014-03-05
4.3
None Remote Medium Not required None None Partial
Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.
5 CVE-2012-5581 119 DoS Exec Code Overflow 2013-01-04 2013-02-07
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
6 CVE-2012-4564 DoS Exec Code Overflow 2012-11-11 2013-02-07
6.8
None Remote Medium Not required Partial Partial Partial
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
7 CVE-2012-4447 119 DoS Exec Code Overflow 2012-10-28 2013-02-07
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.
8 CVE-2012-3401 119 DoS Exec Code Overflow 2012-08-13 2013-05-29
6.8
None Remote Medium Not required Partial Partial Partial
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
9 CVE-2012-2113 189 DoS Exec Code Overflow 2012-07-22 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
10 CVE-2012-2088 189 DoS Exec Code Overflow 2012-07-22 2014-03-16
7.5
None Remote Low Not required Partial Partial Partial
Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.
11 CVE-2012-1173 189 Exec Code Overflow 2012-06-04 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.
12 CVE-2011-1167 119 Exec Code Overflow 2011-03-28 2014-02-20
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.
13 CVE-2010-4665 189 DoS Overflow 2011-05-03 2014-02-20
4.3
None Remote Medium Not required None None Partial
Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF file containing a directory data structure with many directory entries.
14 CVE-2010-3087 119 DoS Exec Code Overflow Mem. Corr. 2010-09-28 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TIFF image.
15 CVE-2010-2631 20 DoS 2010-07-06 2013-05-14
4.3
None Remote Medium Not required None None Partial
LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
16 CVE-2010-2630 20 DoS 2010-07-06 2013-05-14
4.3
None Remote Medium Not required None None Partial
The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
17 CVE-2010-2597 20 DoS 2010-07-02 2013-05-14
4.3
None Remote Medium Not required None None Partial
The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error.
18 CVE-2010-2596 20 DoS 2010-07-02 2013-05-14
4.3
None Remote Medium Not required None None Partial
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
19 CVE-2010-2595 20 DoS 2010-07-02 2013-05-14
4.3
None Remote Medium Not required None None Partial
The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."
20 CVE-2010-2483 119 DoS Overflow 2010-07-06 2013-05-14
4.3
None Remote Medium Not required None None Partial
The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values.
21 CVE-2010-2482 DoS 2010-07-06 2013-05-14
4.3
None Remote Medium Not required None None Partial
LibTIFF 3.9.4 and earlier does not properly handle an invalid td_stripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted TIFF file, a different vulnerability than CVE-2010-2443.
22 CVE-2010-2481 119 DoS Overflow 2010-07-06 2013-05-14
4.3
None Remote Medium Not required None None Partial
The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.
23 CVE-2010-2443 DoS 2010-06-24 2013-05-14
5.0
None Remote Low Not required None None Partial
The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function.
24 CVE-2010-2233 20 DoS Exec Code 2010-07-02 2013-05-14
7.5
None Remote Low Not required Partial Partial Partial
tif_getimage.c in LibTIFF 3.9.0 and 3.9.2 on 64-bit platforms, as used in ImageMagick, does not properly perform vertical flips, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF image, related to "downsampled OJPEG input."
25 CVE-2010-2067 119 DoS Exec Code Overflow 2010-06-24 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tif_dirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long EXIF SubjectDistance field in a TIFF file.
26 CVE-2010-2065 189 DoS Exec Code Overflow 2010-06-24 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.
27 CVE-2009-5022 119 Exec Code Overflow 2011-05-03 2013-05-14
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.
28 CVE-2009-2347 189 Exec Code Overflow 2009-07-14 2013-05-14
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
29 CVE-2009-2285 119 DoS Overflow 2009-07-01 2010-08-24
4.3
None Remote Medium Not required Partial None None
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
30 CVE-2008-2327 119 Exec Code Overflow 2008-08-27 2012-10-30
6.8
User Remote Medium Not required Partial Partial Partial
Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
31 CVE-2006-3465 DoS Exec Code 2006-08-02 2010-08-21
7.5
User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the custom tag support for the TIFF library (libtiff) before 3.8.2 allows remote attackers to cause a denial of service (instability or crash) and execute arbitrary code via unknown vectors.
32 CVE-2006-3464 189 Exec Code Overflow 2006-08-02 2011-09-01
7.5
None Remote Low Not required Partial Partial Partial
TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic operations".
33 CVE-2006-3463 119 DoS Overflow 2006-08-02 2011-06-10
7.8
None Remote Low Not required None None Complete
The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large td_nstrips value, which triggers an infinite loop.
34 CVE-2006-3462 119 Exec Code Overflow 2006-08-02 2011-10-17
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.
35 CVE-2006-3461 Exec Code Overflow 2006-08-02 2010-09-15
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors.
36 CVE-2006-3460 119 DoS Exec Code Overflow 2006-08-02 2011-10-17
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream that is longer than the scan line size (TiffScanLineSize).
37 CVE-2006-3459 119 DoS Exec Code Overflow 2006-08-02 2011-09-06
7.5
User Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.
38 CVE-2006-2656 119 Exec Code Overflow 2006-05-30 2010-04-02
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.
39 CVE-2006-2193 DoS Exec Code Overflow 2006-06-08 2013-08-17
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
40 CVE-2006-2120 DoS 2006-05-01 2010-08-21
2.1
None Local Low Not required None None Partial
The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.
41 CVE-2006-2026 119 DoS Exec Code Overflow 2006-04-25 2013-07-18
6.5
User Remote Low Single system Partial Partial Partial
Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."
42 CVE-2006-2025 DoS Exec Code Overflow 2006-04-25 2010-08-21
6.5
User Remote Low Single system Partial Partial Partial
Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.
43 CVE-2006-2024 DoS 2006-04-25 2010-08-21
4.0
None Remote Low Single system None None Partial
Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.
44 CVE-2006-0405 DoS 2006-01-24 2008-09-05
5.0
None Remote Low Not required None None Partial
The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.
45 CVE-2005-2452 DoS 2005-08-03 2008-09-05
5.0
None Remote Low Not required None None Partial
libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c, a different vulnerability than CVE-2004-0804.
46 CVE-2005-1544 Exec Code Overflow 2005-05-14 2010-03-05
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.
47 CVE-2004-1308 Exec Code Overflow 2005-01-10 2010-08-21
10.0
Admin Remote Low Not required Complete Complete Complete
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
48 CVE-2004-1307 Exec Code Overflow 2004-12-21 2010-08-21
7.5
User Remote Low Not required Partial Partial Partial
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
49 CVE-2004-1183 DoS Exec Code Overflow 2005-01-06 2010-08-21
5.1
User Remote High Not required Partial Partial Partial
Integer overflow in the tiffdump utility for libtiff 3.7.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF file.
50 CVE-2004-0929 Exec Code Overflow 2005-01-27 2008-09-10
10.0
Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled with the OJPEG_SUPPORT (old JPEG support) option, allows remote attackers to execute arbitrary code via a malformed TIFF image.
Total number of vulnerabilities : 53   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.