PT-2014-8419 · Libtiff+3 · Libtiff+4

Published 2014-12-31 · Updated 2024-06-15 · CVE-2014-8128

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions prior to 4.0.4 Apple iOS versions prior to 8.4 OS X versions prior to 10.10.4

Description The issue allows remote attackers to cause a denial of service, specifically an out-of-bounds write, via a crafted TIFF image. This can be exploited by sending a maliciously crafted image to affected devices.

Recommendations For LibTIFF versions prior to 4.0.4, update to version 4.0.4 or later. For Apple iOS versions prior to 8.4, update to iOS 8.4 or later. For OS X versions prior to 10.10.4, update to OS X 10.10.4 or later.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2014-8128

DLA-221-1

DLA-610-1

DLA-693-1

DSA-3273-1

MGASA-2015-0112

MGASA-2017-0199

OPENSUSE-SU-2018_0097-1

OPENSUSE-SU-2024:10554-1

SUSE-SU-2015:1420-1

SUSE-SU-2015:1475-1

SUSE-SU-2018:0073-1

SUSE-SU-2018:1835-1

SUSE-SU-2018_0073-1

SUSE-SU-2018_1835-1

USN-2553-1

USN-2553-2

Affected Products

Libtiff

Os X

Suse

Ubuntu

Ios

References · 171

• 🔥 https://github.com/xiaoqx/pocs/tree/master/libtiff · Exploit
• 🔥 https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-8128 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0073-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Security Note
• https://bdu.fstec.ru/vul/2019-01071 · Security Note
• https://bdu.fstec.ru/vul/2017-00330 · Security Note
• https://ubuntu.com/security/CVE-2014-9330 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8128 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-8128 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1420-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10554-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1547 · Security Note
• https://bdu.fstec.ru/vul/2019-01064 · Security Note