Veracode Vulnerability DatabaseVERACODE:23794Arbitrary Code Execution
0.006 Low
EPSS
Percentile
78.5%
libtiff is vulnerable to arbitrary code execution. The vulnerability exists as several integer overflow flaws, leading to heap-based buffer overflows, were found in various libtiff color space conversion tools. An attacker could create a specially-crafted TIFF file, which once opened by an unsuspecting user, would cause the conversion tool to crash or, potentially, execute arbitrary code with the privileges of the user running the tool.
References
article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/
bugzilla.maptools.org/show_bug.cgi?id=2079
osvdb.org/55821
osvdb.org/55822
secunia.com/advisories/35811
secunia.com/advisories/35817
secunia.com/advisories/35866
secunia.com/advisories/35883
secunia.com/advisories/35911
secunia.com/advisories/36194
secunia.com/advisories/50726
security.gentoo.org/glsa/glsa-200908-03.xml
security.gentoo.org/glsa/glsa-201209-02.xml
www.debian.org/security/2009/dsa-1835
www.mandriva.com/security/advisories?name=MDVSA-2009:150
www.mandriva.com/security/advisories?name=MDVSA-2011:043
www.ocert.org/advisories/ocert-2009-012.html
www.redhat.com/security/updates/classification/#moderate
www.redhat.com/support/errata/RHSA-2009-1159.html
www.securityfocus.com/archive/1/504892/100/0/threaded
www.securityfocus.com/bid/35652
www.securitytracker.com/id?1022539
www.ubuntu.com/usn/USN-801-1
www.vupen.com/english/advisories/2009/1870
www.vupen.com/english/advisories/2011/0621
access.redhat.com/errata/RHSA-2009:1159
bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2347
exchange.xforce.ibmcloud.com/vulnerabilities/51688
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10988
www.redhat.com/archives/fedora-package-announce/2009-July/msg00663.html
www.redhat.com/archives/fedora-package-announce/2009-July/msg00724.html
Related
