CVE-2012-1173
LibTIFF TileSize Parsing Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.
Múltiples desbordamientos de entero en v3.9.4 permite a atacantes remotos ejecutar código a través de un tamaño del "tile" manipulado, que no es gestionado de forma adecuada por las funciones (1) gtTileSeparate o (2) gtStripSeparate, produciendo un desbordamiento de memoria dinámica.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LibTIFF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the LibTIFF Library and occurs when the application attempts to allocate space for a tile. When calculating the size for a buffer, the library will perform a multiply which can cause an integer overflow. After allocation, the library will initialize the buffer with tile data. This can cause code execution under the context of the application that utilizes the LibTIFF library.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-02-14 CVE Reserved
- 2012-03-13 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-189: Numeric Errors
CAPEC
References (29)
| URL | Tag | Source |
|---|---|---|
| http://bugzilla.maptools.org/attachment.cgi?id=477&action=diff | X_refsource_misc | |
| http://bugzilla.maptools.org/show_bug.cgi?id=2369 | X_refsource_confirm | |
| http://home.gdal.org/private/zdi-can-1221/zdi-can-1221.txt | X_refsource_misc | |
| http://secunia.com/advisories/50726 | Third Party Advisory | |
| http://support.apple.com/kb/HT5501 | X_refsource_confirm |
|
| http://support.apple.com/kb/HT5503 | X_refsource_confirm |
|
| http://www.osvdb.org/81025 | Vdb Entry | |
| http://www.securityfocus.com/bid/52891 | Vdb Entry | |
| http://www.securitytracker.com/id?1026895 | Vdb Entry | |
| https://downloads.avaya.com/css/P8/documents/100161772 | X_refsource_confirm | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/74656 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|