Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- libtiff-main
Version range not reported
- ceph
Version range not reported
- ceph
Version range not reported
- ceph
Version range not reported
- ceph
Version range not reported
- ceph
Version range not reported
- boost
Version range not reported
- ceph
Version range not reported
- libtiff
Version range not reported
- libtiff
Version range not reported
- compat-libtiff3
Version range not reported
- libtiff
Version range not reported
- compat-libtiff3
Version range not reported
- libtiff
Version range not reported
- mingw-libtiff
Version range not reported
- boost
Version range not reported
- ceph
Version range not reported
- libtiff
Version range not reported
- boost
Version range not reported