PT-2008-1058 · Libtiff+1 · Libtiff-Devel+2

Published 2008-08-27 · Updated 2024-06-15 · CVE-2008-2327

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libtiff versions prior to 3.8.2 libtiff-devel versions prior to 3.8.2

Description The issue is related to multiple buffer underflows in the LZW decoder functions, specifically in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif lzw.c, allowing context-dependent attackers to execute arbitrary code via a crafted TIFF file. This is due to improper handling of the CODE CLEAR code. The exploitation of these vulnerabilities can lead to a disruption of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For libtiff versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. For libtiff-devel versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the LZW decoder functions until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-06337

BDU:2015-06343

BDU:2015-07390

BDU:2015-07391

BDU:2015-08353

BDU:2015-08354

BDU:2015-08439

BDU:2015-08440

BDU:2015-09341

CVE-2008-2327

DSA-1632-1

DTSA-160-1

OPENSUSE-SU-2024:11461-1

RHSA-2008:0847

RHSA-2008:0848

RHSA-2008:0863

RHSA-2008_0847

RHSA-2008_0848

Affected Products

Red Hat

Libtiff

Libtiff-Devel

References · 117

• http://security.gentoo.org/glsa/glsa-200809-07.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:184 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08353 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06343 · Security Note
• http://secunia.com/advisories/31610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06337 · Security Note
• http://secunia.com/advisories/31698 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2327 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2327 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2971 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-2327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2327 · Security Note
• http://secunia.com/advisories/31668 · Vendor Advisory