PT-2013-1165 · Libtiff+5 · Libtiff+5
Frank Warmerdam
·
Published
2013-08-30
·
Updated
2024-06-15
·
CVE-2013-4244
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff versions prior to 4.0.3
libtiff-debuginfo versions 3.8.2, 3.9.4
libtiff-static version 3.9.4
libtiff-devel version 3.9.4
Description
The issue concerns multiple vulnerabilities in the libtiff package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The LZW decompressor in the gif2tiff tool in libtiff allows context-dependent attackers to cause a denial of service or possibly execute arbitrary code via a crafted GIF image.
Recommendations
For libtiff versions prior to 4.0.3, update to version 4.0.3 or later.
For libtiff-debuginfo versions 3.8.2, 3.9.4, update to a version that is not affected by the vulnerability.
For libtiff-static version 3.9.4, update to a version that is not affected by the vulnerability.
For libtiff-devel version 3.9.4, update to a version that is not affected by the vulnerability.
As a temporary workaround, consider restricting access to the gif2tiff tool until a patch is available.
Fix
DoS
Buffer Overflow
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libtiff