Numeric Errors Affecting tiff package, versions <3.8.2-13


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.59% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-TIFF-405920
  • published14 Jul 2009
  • disclosed14 Jul 2009

Introduced: 14 Jul 2009

CVE-2009-2347  (opens in a new tab)
CWE-189  (opens in a new tab)

How to fix?

Upgrade Debian:unstable tiff to version 3.8.2-13 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

References

CVSS Scores

version 3.1