PT-2013-1166 · Libtiff+5 · Libtiff+5
Murray Mcallister
·
Published
2013-09-10
·
Updated
2024-06-15
·
CVE-2013-4243
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff versions 3.9.4 and earlier
libtiff versions 4.0.3 and earlier
Description
The issue is related to multiple vulnerabilities in the libtiff package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A heap-based buffer overflow in the readgifimage function in the gif2tiff tool allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted height and width values in a GIF image.
Recommendations
For libtiff versions 3.9.4 and earlier, update to a version later than 3.9.4 to resolve the issue.
For libtiff versions 4.0.3 and earlier, update to a version later than 4.0.3 to resolve the issue.
As a temporary workaround, consider disabling the readgifimage function in the gif2tiff tool until a patch is available.
Restrict access to the gif2tiff tool to minimize the risk of exploitation.
Fix
DoS
Buffer Overflow
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libtiff