PT-2010-1128 · Libtiff+1 · Libtiff+1

Sauli Pahlman + 1 · Published 2010-07-06 · Updated 2023-02-13 · CVE-2010-2482

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibTIFF versions 3.9.4 and earlier tiff versions prior to 4.0.2-r1

Description The issue arises from improper handling of an invalid td stripbytecount field in crafted TIFF files, leading to a denial of service through a NULL pointer dereference and application crash. Additionally, multiple vulnerabilities in the tiff package can compromise the confidentiality, integrity, and availability of protected information, with potential for remote exploitation.

Recommendations For LibTIFF versions 3.9.4 and earlier, update to a version later than 3.9.4 to resolve the issue. For tiff versions prior to 4.0.2-r1, update to version 4.0.2-r1 or later to address the vulnerabilities.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-09646

CVE-2010-2482

DSA-2552-1

Affected Products

Libtiff

Tiff

References · 19

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=603024 · Exploit
• 🔥 https://exploit-db.com/exploits/14573 · Exploit
• http://security.gentoo.org/glsa/glsa-201209-02.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2482 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09646 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2482 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2482 · Vendor Advisory
• http://secunia.com/advisories/40422 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2482 · Vendor Advisory
• http://debian.org/security/2012/dsa-2552 · Vendor Advisory
• http://marc.info/?l=oss-security&m=127736307002102&w=2 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7 · Note
• http://openwall.com/lists/oss-security/2010/06/30/22 · Note
• http://marc.info/?l=oss-security&m=127738540902757&w=2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=608010 · Note