Red Hat Security Advisory

RHSA-2014:0223

libtiff security update

Released 2014-02-27 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) libtiff-3.8.2-19.el5_10, libtiff-3.8.2-19.el5_10.i386, libtiff-3.8.2-19.el5_10.ia64 +5
Red Hat Enterprise Linux Desktop (v. 5 client) libtiff-3.8.2-19.el5_10, libtiff-3.8.2-19.el5_10.i386
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libtiff-3.8.2-19.el5_10, libtiff-devel-3.8.2-19.el5_10, libtiff-devel-3.8.2-19.el5_10.i386

Fixes 6 records

TI-2013-01735 CVE-2013-1960 · GHSA-vqhx-4gwh-xx5q

Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff…

MEDIUM 54

Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TI…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.11823 Published 2013-07-03 Fixed CWE-119

TI-2013-01736 CVE-2013-1961 · GHSA-7q9j-26p4-98cm

Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff…

MEDIUM 49

Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a T…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05913 Published 2013-07-03 Fixed CWE-119

TI-2013-03714 CVE-2013-4243 · GHSA-4mjh-684p-r652

Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff…

MEDIUM 40

Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted hei…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.07165 Published 2013-09-10 Fixed CWE-119

TI-2013-03703 CVE-2013-4232 · GHSA-m5m4-9rh8-rjhp

Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c…

LOW 38

Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05019 Published 2013-09-10 Fixed CWE-399

TI-2013-03715 CVE-2013-4244 · GHSA-537w-v4qr-w65f

The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows…

LOW 35

The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02699 Published 2013-09-28 Fixed CWE-119

TI-2013-03702 CVE-2013-4231 · GHSA-4qfr-3jpc-g89j

Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a…

LOW 30

Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07399 Published 2014-01-19 Fixed CWE-119