CVE-2012-2088 — Heap-based Buffer Overflow in Tiff

CWE-189CWE-122 — Heap-based Buffer Overflow9 documents7 sources
Severity
7.5HIGHNVD
EPSS
3.0%
top 13.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian TiffLibtiff
Timeline
PublishedJul 22
Latest updateMay 14

Description

Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDlibtiff/libtiff3.9.4+24
▶debiandebian/tiff< tiff 4.0-1 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-2p93-pprm-392q: Integer signedness error in the TIFFReadDirectory function in tif_dirread↗2022-05-14
▶
OSV
CVE-2012-2088: Integer signedness error in the TIFFReadDirectory function in tif_dirread↗2012-07-22
▶

📋Vendor Advisories

3
Ubuntu
tiff vulnerabilities↗2012-07-05
▶
Red Hat
libtiff: Type conversion flaw leading to heap-buffer overflow↗2012-06-15
▶
Debian
CVE-2012-2088: tiff - Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in l...↗2012
▶

💬Community

3
Bugzilla
CVE-2012-2113 CVE-2012-2088 libtiff various flaws [fedora-all]↗2012-06-18
▶
Bugzilla
CVE-2012-2088 libtiff: Type conversion flaw leading to heap-buffer overflow↗2012-06-18
▶
Bugzilla
CVE-2012-2113 libtiff: integer overflow in tiff2pdf leading to heap-buffer overflow when reading a tiled tiff file↗2012-04-06
▶