PT-2010-1128 · Libtiff+1 · Libtiff+1

Sauli Pahlman + 1 · Publicado 2010-07-06 · Atualizado 2023-02-13 · CVE-2010-2482

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibTIFF versions 3.9.4 and earlier tiff versions prior to 4.0.2-r1

Description The issue arises from improper handling of an invalid td stripbytecount field in crafted TIFF files, leading to a denial of service through a NULL pointer dereference and application crash. Additionally, multiple vulnerabilities in the tiff package can compromise the confidentiality, integrity, and availability of protected information, with potential for remote exploitation.

Recommendations For LibTIFF versions 3.9.4 and earlier, update to a version later than 3.9.4 to resolve the issue. For tiff versions prior to 4.0.2-r1, update to version 4.0.2-r1 or later to address the vulnerabilities.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-09646

CVE-2010-2482

DSA-2552-1

Produtos afetados

Libtiff

Tiff

Referências · 19

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=603024 · Exploit
• 🔥 https://exploit-db.com/exploits/14573 · Exploit
• http://marc.info/?l=oss-security&m=127736307002102&w=2 · Nota
• http://security.gentoo.org/glsa/glsa-201209-02.xml · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2482 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09646 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7 · Nota
• http://openwall.com/lists/oss-security/2010/06/30/22 · Nota
• http://marc.info/?l=oss-security&m=127738540902757&w=2 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=608010 · Nota
• https://bugs.launchpad.net/bugs/597246 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2482 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2010-2482 · Aviso do Fabricante
• http://secunia.com/advisories/40422 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-2482 · Aviso do Fabricante