LibTIFF vulnerabilities

An out-of-memory flaw was found in libtiff. Passing a crafted TIFF file to the TIFFOpen() API may allow a remote attacker to cause a denial of service via crafted input smaller than 379 KB.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

A vulnerability in the libtiff library allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c.

The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in libtiff before version 4.0.7 allow remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.

In libtiff version 4.0.6, there is an out-of-bounds write in the tiffcp tool that affects tiled images with odd tile width versus image width. This issue was reported as MSVR 35103, also known as 'cpStripToTile heap-buffer-overflow.'

The libtiff library version 4.0.6 has an out-of-bounds read in the readContigTilesIntoBuffer() function.

In libtiff version 4.0.6, there is a vulnerability related to a buffer overflow in the readContigStripsIntoBuffer() function, leading to reading an undefined buffer.

The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in the tiffcrop.c tool. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.

The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in the t2p_process_jpeg_strip() function.

The libtiff library version 4.0.6 has an issue in the error code path of the TIFFFlushData1() function that does not reset the tif_rawcc and tif_rawcp members. This leads to a heap buffer overflow.

In libtiff version 4.0.6, there are out-of-bounds write vulnerabilities in heap allocated buffers related to tif_pixarlog.c. This issue was reported as MSVR 35094, also known as 'PixarLog horizontalDifference heap-buffer-overflow.'

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff version 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.

A heap-buffer overflow vulnerability exists in the libtiff tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. A 64-bit StripByteCounts value is truncated to a 32-bit integer, leading to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component.

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image.

Vulnerability in libtiff library. A remote attacker can supply a specially crafted PixarLog-compressed TIFF image. The issue occurs when decoding Pixarlog codec images with PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could result in arbitrary code execution or denial of service (DoS).

A flaw was found in the libtiff library, involving a signed integer overflow in the putcontig8bitYCbCr44tile function. A remote attacker can exploit this by providing a specially crafted TIFF file, leading to an out-of-bounds heap write due to incorrect memory pointer calculations.

A flaw was found in Libtiff, a 'write-what-where' condition triggered when processing a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location.

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

A flaw was found in libtiff that can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function. A specially crafted TIFF file can cause a denial of service.

A buffer overflow vulnerability was found in Libtiff version 4.0.7. A local attacker can exploit the tiffcp function in tiffcp.c to cause a denial of service (DoS).

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted TIFF file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

A heap buffer overflow flaw was found in Libtiff's tiffinfo.c in the TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.