PT-2013-1164 · Libtiff+5 · Libtiff+5

Murray Mcallister + 1 · Published 2013-08-22 · Updated 2024-06-15 · CVE-2013-4232

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libtiff versions prior to 4.0.3 libtiff-debuginfo versions 3.8.2 and 3.9.4 libtiff-static versions 3.8.2 and 3.9.4 libtiff-devel versions 3.8.2 and 3.9.4

Description The issue is related to multiple vulnerabilities in the libtiff package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, a use-after-free vulnerability in the t2p readwrite pdf image function in tools/tiff2pdf.c allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted TIFF image.

Recommendations For libtiff versions prior to 4.0.3, update to version 4.0.3 or later. For libtiff-debuginfo versions 3.8.2 and 3.9.4, update to a version that includes the fix for this issue. For libtiff-static versions 3.8.2 and 3.9.4, update to a version that includes the fix for this issue. For libtiff-devel versions 3.8.2 and 3.9.4, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the t2p readwrite pdf image function until a patch is available.

Fix

DoS

Buffer Overflow

RCE

Weakness Enumeration

CWE-119

CWE-20

CWE-399

Related Identifiers

ALT-PU-2019-1628

BDU:2015-06338

BDU:2015-06339

BDU:2015-06340

BDU:2015-06344

BDU:2015-06345

BDU:2015-08609

BDU:2015-08610

BDU:2015-08611

BDU:2015-08612

BDU:2015-09010

BDU:2015-09718

CESA-2014_0222

CVE-2013-4232

DSA-2744-1

MGASA-2013-0258

OPENSUSE-SU-2024:10554-1

RHSA-2014:0222

RHSA-2014:0223

RHSA-2014_0222

RHSA-2014_0223

USN-2205-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libtiff

References · 194

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• https://bdu.fstec.ru/vul/2015-09010 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4243 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8783 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4232 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4244 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4564 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3621 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4232 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9935 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3624 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9453 · Security Note
• http://secunia.com/advisories/54628 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4232 · Vendor Advisory