Debian Tiff vulnerabilities

CVE-2023-6277 [MEDIUM] CVE-2023-6277: tiff - An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFO... An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 4.5.1+git230720-2) sid: resolved (fixed in 4.5.1+git230720-2) trixie: resolved (fixed in 4.5.1+git230720-2

CVE-2022-0891 [MEDIUM] CVE-2022-0891: tiff - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff ... A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Scope: local bookworm: resolved (fixed in 4.3.0-6) bullseye: r

CVE-2006-3464 [HIGH] CVE-2006-3464: tiff - TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass n... TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic operations". Scope: local bookworm: resolved (fixed in 3.8.2-6) bullseye: resolv

CVE-2017-7592 [HIGH] CVE-2017-7592: tiff - The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift un... The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6

CVE-2019-7663 [HIGH] CVE-2019-7663: tiff - An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfu... An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900. Scope: local bookworm: resolved (fix

CVE-2018-7456 [MEDIUM] CVE-2018-7456: tiff - A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_prin... A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-180

CVE-2017-7602 [HIGH] CVE-2017-7602: tiff - LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers ... LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6) sid: resolved (fixed in 4.0.7-6) trixie: resolved (fixed

CVE-2017-7599 [HIGH] CVE-2017-7599: tiff - LibTIFF 4.0.7 has an "outside the range of representable values of type short" u... LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-

CVE-2017-7596 [HIGH] CVE-2017-7596: tiff - LibTIFF 4.0.7 has an "outside the range of representable values of type float" u... LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-

CVE-2017-7597 [HIGH] CVE-2017-7597: tiff - tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values... tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved

CVE-2023-3618 [MEDIUM] CVE-2023-3618: tiff - A flaw was found in libtiff. A specially crafted tiff file can lead to a segment... A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. Scope: local bookworm: resolved (fixed in 4.5.0-6+deb12u2) bullseye: resolved (fixed in 4.2.0-1+deb11u6) forky: resolved (fixed in 4.5.1~rc3-1) sid: resolved (fixed in 4.

CVE-2017-7598 [HIGH] CVE-2017-7598: tiff - tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of... tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6) sid: resolved (fixed in 4.0.7-6) trixie: resolved (fixed in 4.0.7-6)

CVE-2017-7601 [HIGH] CVE-2017-7601: tiff - LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined be... LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6) sid: res

CVE-2017-7600 [HIGH] CVE-2017-7600: tiff - LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned... LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed i

CVE-2019-14973 [MEDIUM] CVE-2019-14973: tiff - _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mi... _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. Scope: local bookworm: resolved (fixed in 4.0.10+git190814-1) bullseye: resolved (fixed in 4.0.10+git190814-1) forky

CVE-2018-19210 [MEDIUM] CVE-2018-19210: tiff - In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectoryS... In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. Scope: local bookworm: resolved (fixed in 4.0.10-4) bullseye: resolved (fixed in 4.0.10-4) forky: resolved (fixed in 4.0.10-4) sid: resolved (fixed in 4.0.10-4) trixie: resolved (fixed

CVE-2015-1547 [MEDIUM] CVE-2015-1547: tiff - The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to caus... The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. Scope: local bookworm: resolved (fixed in 4.0.3-12.1) bullseye: resolved (fixed in 4.0.3-12.1) forky: resolved (fixed in 4.0.3-12.1) sid: resolved (fixed in 4.0.3-12.1) trixie: res

CVE-2018-17000 [MEDIUM] CVE-2018-17000: tiff - A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called fro... A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. Scope: local bookworm: resolved (fixed in 4.0.10-4) bullseye: resolved (fixed in 4.0.10-4) f

CVE-2018-5784 [MEDIUM] CVE-2018-5784: tiff - In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDi... In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. Scope: local bookworm: resolve

CVE-2017-11613 [MEDIUM] CVE-2017-11613: tiff - In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen fun... In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based