PT-2013-1165 · Libtiff+5 · Libtiff+5
Frank Warmerdam
·
Publicado
2013-08-30
·
Atualizado
2024-06-15
·
CVE-2013-4244
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff versions prior to 4.0.3
libtiff-debuginfo versions 3.8.2, 3.9.4
libtiff-static version 3.9.4
libtiff-devel version 3.9.4
Description
The issue concerns multiple vulnerabilities in the libtiff package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The LZW decompressor in the gif2tiff tool in libtiff allows context-dependent attackers to cause a denial of service or possibly execute arbitrary code via a crafted GIF image.
Recommendations
For libtiff versions prior to 4.0.3, update to version 4.0.3 or later.
For libtiff-debuginfo versions 3.8.2, 3.9.4, update to a version that is not affected by the vulnerability.
For libtiff-static version 3.9.4, update to a version that is not affected by the vulnerability.
For libtiff-devel version 3.9.4, update to a version that is not affected by the vulnerability.
As a temporary workaround, consider restricting access to the gif2tiff tool until a patch is available.
Correção
DoS
Buffer Overflow
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libtiff