CVE-2019-17546

libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.

El archivo tif_getimage.c en LibTIFF versiones hasta 4.0.10, como es usado en GDAL hasta 3.0.1 y otros productos, presenta un desbordamiento de enteros que causa potencialmente un desbordamiento de búfer en la región heap de la memoria por medio de una imagen RGBA diseñada, relacionada con una condición "Negative-size-param".

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-10-14 CVE Reserved
2019-10-14 CVE Published
2024-08-05 CVE Updated
2024-10-07 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-122: Heap-based Buffer Overflow
CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write

CAPEC

References (13)

URL	Tag	Source
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html	Mailing List
https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html	Mailing List
https://seclists.org/bugtraq/2020/Jan/32	Mailing List

URL	Date	SRC

URL	Date	SRC
https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf	2023-11-07
https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145	2023-11-07

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG	2023-11-07
https://security.gentoo.org/glsa/202003-25	2023-11-07
https://www.debian.org/security/2020/dsa-4608	2023-11-07
https://www.debian.org/security/2020/dsa-4670	2023-11-07
https://access.redhat.com/security/cve/CVE-2019-17546	2020-11-04
https://bugzilla.redhat.com/show_bug.cgi?id=1765705	2020-11-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Libtiff Search vendor "Libtiff"		Libtiff Search vendor "Libtiff" for product "Libtiff"				< 4.1.0 Search vendor "Libtiff" for product "Libtiff" and version " < 4.1.0"		-		Affected
Osgeo Search vendor "Osgeo"		Gdal Search vendor "Osgeo" for product "Gdal"				<= 3.0.1 Search vendor "Osgeo" for product "Gdal" and version " <= 3.0.1"		-		Affected