PT-2012-1117 · Libtiff+3 · Libtiff+3

Alexander Gavrun

·

Publicado

2012-03-13

·

Atualizado

2024-06-15

·

CVE-2012-1173

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions LibTIFF versions prior to 4.0.2
Description The issue is related to multiple integer overflows in the tiff getimage.c file of LibTIFF, which can be exploited remotely. This can lead to the execution of arbitrary code via a crafted tile size in a TIFF file, resulting in a heap-based buffer overflow. The exploitation of these issues can compromise the confidentiality, integrity, and availability of protected information.
Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of LibTIFF until a patch is applied.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-09646
CESA-2012_0468
CVE-2012-1173
DSA-2447-1
OPENSUSE-SU-2024:10554-1
RHSA-2012:0468
RHSA-2012_0468
SUSE-SU-2012_0516-1
SUSE-SU-2013_1639-1
ZDI-12-043

Produtos afetados

Centos
Libtiff
Red Hat
Suse