PT-2012-6334 · Sam Leffler+3 · Libtiff+4

Huzaifa S. Sidhpurwala · Published 1970-01-01 · Updated 2023-02-13 · CVE-2012-2088

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libtiff versions prior to 4.0.2 tiff versions prior to 4.0.2-r1 libtiff3 versions prior to 3.9.4 libtiff-devel versions prior to 3.9.4 libtiff-x86 versions prior to 3.9.4 libtiff-32bit versions prior to 3.9.4 libtiff-64bit versions prior to 3.9.4 libtiff3-32bit versions prior to 3.9.4 libtiff3-x86 versions prior to 3.9.4 libtiff-devel-32bit versions prior to 3.9.4 libtiff-devel-64bit versions prior to 3.9.4

Description The issue is related to multiple vulnerabilities in the libtiff package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code. The vulnerabilities are caused by an integer signedness error in the TIFFReadDirectory function, which can trigger an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.

Recommendations For libtiff versions prior to 4.0.2, update to version 4.0.2 or later. For tiff versions prior to 4.0.2-r1, update to version 4.0.2-r1 or later. For libtiff3 versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-devel versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-x86 versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-32bit versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-64bit versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff3-32bit versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff3-x86 versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-devel-32bit versions prior to 3.9.4, update to version 3.9.4 or later. For libtiff-devel-64bit versions prior to 3.9.4, update to version 3.9.4 or later. As a temporary workaround, consider disabling the TIFFReadDirectory function until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-04494

BDU:2015-04495

BDU:2015-04496

BDU:2015-04497

BDU:2015-04498

BDU:2015-04499

BDU:2015-04500

BDU:2015-04501

BDU:2015-04502

BDU:2015-04503

BDU:2015-04504

BDU:2015-09646

CESA-2012_1054

CVE-2012-2088

DSA-2552-1

RHSA-2012:1054

RHSA-2012_1054

SUSE-SU-2012_0894-1

Affected Products

Centos

Red Hat

Suse

Libtiff

Tiff

References · 49

• http://secunia.com/advisories/49686 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00010.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09646 · Security Note
• https://bdu.fstec.ru/vul/2015-04501 · Security Note
• https://bdu.fstec.ru/vul/2015-04499 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-1054.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2088 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04497 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:101 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04494 · Security Note
• https://bdu.fstec.ru/vul/2015-04504 · Security Note
• https://bdu.fstec.ru/vul/2015-04502 · Security Note
• https://bdu.fstec.ru/vul/2015-04498 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2113 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2088 · Security Note