LibTIFF vulnerabilities

In LibTIFF version 4.0.8, there is a heap-based use-after-free vulnerability in the t2p_writeproc function in tiff2pdf.c.

In LibTIFF version 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.

The pal2rgb tool in LibTIFF 4.0.9 has a vulnerability that allows remote attackers to cause application crashes via a crafted TIFF file due to a heap-based buffer overflow.

The TIFFReadDirEntryArray function in LibTIFF 4.0.8 mishandles memory allocation for short files, potentially leading to application crashes during tiff2pdf invocation.

There is a heap based buffer overflow in LibTIFF 4.0.8 in tools/tiff2pdf.c triggered by a PlanarConfig=Contig image. This can lead to an out-of-bounds write and potentially to remote denial of service or arbitrary code execution attacks.

In LibTIFF version 4.0.8, there is an assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. Crafted input can lead to a remote denial of service attack.

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function, which could lead to various damages. A crafted TIFF document can lead to out-of-bounds read, invalid free, or memory corruption, potentially allowing arbitrary code execution.

LibTIFF version 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF version 4.0.7 has an undefined behavior issue related to 'shift exponent too large for 64-bit type long', which may lead to application crashes.

LibTIFF version 4.0.7 has an undefined behavior issue related to values outside the range of representable values of type unsigned char, which may allow remote attackers to cause application crashes or possibly have unspecified other impacts via a crafted image.

LibTIFF version 4.0.7 has an undefined behavior issue when values are outside the range of representable values of type short. This may allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

The tif_dirread.c file in LibTIFF 4.0.7 may have a divide-by-zero error that allows remote attackers to cause application crashes via a crafted image.

The tif_dirread.c in LibTIFF 4.0.7 has an undefined behavior issue related to 'outside the range of representable values of type float', which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF version 4.0.7 has an undefined behavior issue related to 'outside the range of representable values of type float', which may lead to application crashes or other unspecified impacts via a crafted image.

The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

LibTIFF version 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image.

LibTIFF version 4.0.7 contains a vulnerability that allows remote attackers to cause a denial of service through a crafted TIFF image. The issue relates to buffer over-read and buffer overflow errors.

LibTIFF version 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image.

LibTIFF versions from 4.0.0alpha4 to 4.0.7 allow remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image.

LibTIFF version 4.0.7 contains a vulnerability that allows remote attackers to cause a denial of service through a crafted TIFF image. The issue relates to an integer underflow and heap-based buffer under-read.

Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.

Integer overflow in tools/tiffcp.c in LibTIFF versions 4.0.7 and 3.9.x allows remote attackers to have unspecified impact via a crafted image, leading to a heap-based buffer overflow.

Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF allows remote attackers to have unspecified impact via a crafted image. Versions 4.0.7 and 3.9.x up to 4.0.6 are affected.

The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays.

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c, resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.

The _TIFFFax3fillruns function in libtiff before version 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.

LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.

Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.

The TIFFWriteDirectoryTagLongLong8Array function in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable.

The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching.

The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable.

The cpStrips and cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the bytecounts[] array variable.

The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) by setting the "-v" option to -1.

The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0.

The LZWEncode function in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the '-c lzw' option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

The ZIPEncode function in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the '-c zip' option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

A heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via a crafted TIFF image with zero tiles.

A heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier can be exploited by remote attackers. Attackers can cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.

Multiple integer overflows in the cvt_by_strip and cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.

The _TIFFVGetField function in tif_dirinfo.c in LibTIFF version 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.

A heap-buffer-overflow vulnerability was found in LibTIFF in the extractImageSection() function at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801, which can lead to denial of service via a crafted TIFF file.

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This may allow an attacker to trigger memory allocation failures, causing a segmentation fault and application crash.

A vulnerability in the libtiff library allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c.

The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in libtiff before version 4.0.7 allow remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.

In libtiff version 4.0.6, there is an out-of-bounds write in the tiffcp tool that affects tiled images with odd tile width versus image width. This issue was reported as MSVR 35103, also known as 'cpStripToTile heap-buffer-overflow.'

The libtiff library version 4.0.6 has an out-of-bounds read in the readContigTilesIntoBuffer() function.

In libtiff version 4.0.6, there is a vulnerability related to a buffer overflow in the readContigStripsIntoBuffer() function, leading to reading an undefined buffer.

The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in the tiffcrop.c tool. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.