PT-2006-1045 · Libtiff+1 · Libtiff+1

Published 2006-01-25 · Updated 2024-06-15 · CVE-2006-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: libtiff versions prior to 3.8.1

Description: The issue affects the tiff package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely by an authenticated attacker. Specifically, the TIFFFetchShortPair function in tif dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference.

Recommendations: For versions prior to 3.8.1, update to version 3.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to TIFF images from untrusted sources to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09499

CVE-2006-0405

OPENSUSE-SU-2024:11461-1

Affected Products

Gentoo Linux

Libtiff

References · 63

• http://secunia.com/advisories/18587 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0405 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0302 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200605-17.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09499 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-0405 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-0405 · Vendor Advisory
• http://secunia.com/advisories/20345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0405 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11461-1 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24275 · Note
• https://suse.com/security/cve/CVE-2018-10963 · Note
• https://suse.com/security/cve/CVE-2008-2327 · Note
• https://suse.com/security/cve/CVE-2017-11613 · Note
• https://suse.com/security/cve/CVE-2018-7456 · Note