CVE-2019-17546
libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
El archivo tif_getimage.c en LibTIFF versiones hasta 4.0.10, como es usado en GDAL hasta 3.0.1 y otros productos, presenta un desbordamiento de enteros que causa potencialmente un desbordamiento de búfer en la región heap de la memoria por medio de una imagen RGBA diseñada, relacionada con una condición "Negative-size-param".
An update that fixes 8 vulnerabilities is now available. This update for tiff fixes the following issues. Fixed DoS in tools/pal2rgb.c in pal2rgb. Fixed integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image. Fixed buffer overflow in tiffcrop that may cause DoS via the invertImage function. Fixed memory allocation failure in tif_read.c. Fixed memory allocation failure in tif_pixarlog.c. Fixed integer overflow in tif_getimage.c. Fixed heap-based buffer overflow in TIFF2PDF tool. Fixed out-of-bounds read in _TIFFmemcpy in tif_unix.c.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-10-14 CVE Reserved
- 2019-10-14 CVE Published
- 2024-12-20 CVE Updated
- 2025-08-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-190: Integer Overflow or Wraparound
- CWE-787: Out-of-bounds Write
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html | Mailing List |
|
| https://seclists.org/bugtraq/2020/Jan/32 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf | 2023-11-07 | |
| https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libtiff Search vendor "Libtiff" | Libtiff Search vendor "Libtiff" for product "Libtiff" | < 4.1.0 Search vendor "Libtiff" for product "Libtiff" and version " < 4.1.0" | - |
Affected
| ||||||
| Osgeo Search vendor "Osgeo" | Gdal Search vendor "Osgeo" for product "Gdal" | <= 3.0.1 Search vendor "Osgeo" for product "Gdal" and version " <= 3.0.1" | - |
Affected
| ||||||