CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2009-2347 – libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE)
https://notcve.org/view.php?id=CVE-2009-2347
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr. Múltiples desbordamientos de enteros en las herramientas de conversión de inter-color spaces de libtiff v3.8 hasta v3.8.2 y v4.0, permiten a atacantes dependientes del contexto ejecutar código de su elección a través de una imagen TIFF con valores grandes para el (1) ancho y (2) alto. Esto provoca un desbordamiento de búfer basado en memoria dinámica -heap- en (a) la función cvt_whole_image de tiff2rgba y (b) la función tiffcvt de rgb2ycbcr. • http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563 http://bugzilla.maptools.org/show_bug.cgi?id=2079 http://osvdb.org/55821 http://osvdb.org/55822 http://secunia.com/advisories/35811 http://secunia.com/advisories/35817 http://secunia.com/advisories/35866 http://secunia.com/advisories/35883 http://secunia.com/advisories/35911 http://secunia.com/advisories/36194 http://secunia.com/advisories/50726 http://security.gentoo.org/glsa/glsa-200908-03.xml • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 7CVE-2009-2285 – LibTIFF 3.8.2 - 'LZWDecodeCompat()' Remote Buffer Underflow
https://notcve.org/view.php?id=CVE-2009-2285
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327. Desbordamiento de búfer inferior en la función LZWDecodeCompat en libtiff v3.8.2, permite a atacantes dependientes de contexto provocar una denegación de servicio (caída) a través de una imagen TIFF. Vulnerabilidad distinta de CVE-2008-2327. • https://www.exploit-db.com/exploits/33049 https://www.exploit-db.com/exploits/10205 http://bugzilla.maptools.org/show_bug.cgi?id=2065 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2010/Feb/msg00000.html http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html http://lists.apple.com/archives/security-announce/2010/Mar& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 15EXPL: 0CVE-2008-2327 – libtiff: use of uninitialized memory in LZW decoder
https://notcve.org/view.php?id=CVE-2008-2327
Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code. Múltiples desbordamientos de búfer en las funciones (1) LZWDecode, (2) LZWDecodeCompat y (3) LZWDecodeVector en el archivo tif_lzw.c en el decodificador LZW en LibTIFF versión 3.8.2 y anteriores, permite a los atacantes dependiendo del contexto ejecutar código arbitrario por medio de un archivo TIFF diseñado, relacionado con el manejo inapropiado del código CODE_CLEAR. • http://bugs.gentoo.org/show_bug.cgi?id=234080 http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://secunia.com/advisories/31610 http://secunia.com/advisories/31623 http://secunia.com/advisories/31668 http://secunia.com/advisories/31670 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 15EXPL: 1CVE-2006-2193 – tiff2pdf buffer overflow
https://notcve.org/view.php?id=CVE-2006-2193
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355 http://bugzilla.remotesensing.org/show_bug.cgi?id=1196 http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html http://secunia.com/advisories/20488 http://secunia.com/advisories/20501 http://secunia.com/advisories/20520 http://secunia.com/advisories/20693 http://secunia.com/advisories/20766 http://secunia.com/advisories/21002 http://secunia.com/advisories/27181 http://secunia.com/advisories/27222 http:&#x •
CVSS: 7.5EPSS: 2%CPEs: 15EXPL: 1CVE-2006-2656 – tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-2656
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE. Desbordamiento de búfer basado en pila en el comando tiffsplit en libtiff 3.8.2 y versiones anteriores podría permitir a atacantes ejecutar código arbitrario a través de un nombre de archivo largo. NOTA: tiffsplit no es setuid. • https://www.exploit-db.com/exploits/1831 http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html http://marc.info/?l=vuln-dev&m=114857412916909&w=2 http://secunia.com/advisories/20501 http://secunia.com/advisories/20520 http://secunia.com/advisories/20766 http://secunia.com/advisories/21002 http://security.gentoo.org/glsa/glsa-200607-03.xml http://www.debian.org/security/2006/dsa-1091 http://www.mandriva.com/security/advisories?name=MDKSA-2006:095 ht • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •