LibTIFF vulnerabilities

The libtiff library version 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in the t2p_process_jpeg_strip() function.

The libtiff library version 4.0.6 has an issue in the error code path of the TIFFFlushData1() function that does not reset the tif_rawcc and tif_rawcp members. This leads to a heap buffer overflow.

In libtiff version 4.0.6, there are out-of-bounds write vulnerabilities in heap allocated buffers related to tif_pixarlog.c. This issue was reported as MSVR 35094, also known as 'PixarLog horizontalDifference heap-buffer-overflow.'

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff version 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.

A heap-buffer overflow vulnerability exists in the libtiff tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. A 64-bit StripByteCounts value is truncated to a 32-bit integer, leading to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component.

An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image.

Vulnerability in libtiff library. A remote attacker can supply a specially crafted PixarLog-compressed TIFF image. The issue occurs when decoding Pixarlog codec images with PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could result in arbitrary code execution or denial of service (DoS).

A flaw was found in the libtiff library, involving a signed integer overflow in the putcontig8bitYCbCr44tile function. A remote attacker can exploit this by providing a specially crafted TIFF file, leading to an out-of-bounds heap write due to incorrect memory pointer calculations.

A flaw was found in Libtiff, a 'write-what-where' condition triggered when processing a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location.

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

A flaw was found in libtiff that can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function. A specially crafted TIFF file can cause a denial of service.

A buffer overflow vulnerability was found in Libtiff version 4.0.7. A local attacker can exploit the tiffcp function in tiffcp.c to cause a denial of service (DoS).