PT-2014-1830 · Libtiff+4 · Libtiff-Devel+8
Publicado
2013-08-22
·
Atualizado
2024-06-15
·
CVE-2013-4231
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff versions prior to 4.0.3
libtiff-debuginfo versions 3.8.2 and 3.9.4
libtiff-static version 3.9.4
libtiff-devel version 3.9.4
tiff versions prior to 4.0.3-r6
Description
The issue involves multiple vulnerabilities in the libtiff package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service due to out-of-bounds write. The exploitation can occur through crafted images, including GIF images with malicious extension blocks or long filenames for TIFF images.
Recommendations
For libtiff versions prior to 4.0.3, update to version 4.0.3 or later.
For libtiff-debuginfo versions 3.8.2 and 3.9.4, update to a version that includes the fix for this issue.
For libtiff-static version 3.9.4, update to a version that includes the fix for this issue.
For libtiff-devel version 3.9.4, update to a version that includes the fix for this issue.
For tiff versions prior to 4.0.3-r6, update to version 4.0.3-r6 or later.
As a temporary workaround, consider restricting access to tools that utilize the libtiff package until a patch is available.
Correção
DoS
Buffer Overflow
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Suse
Ubuntu
Libtiff
Libtiff-Debuginfo
Libtiff-Devel
Libtiff-Static
Tiff