Описание
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| tiff | fixed | 4.0.3-12.3+deb8u2 | jessie | package |
| tiff | fixed | 4.0.6-3 | package | |
| tiff3 | removed | package | ||
| tiff3 | not-affected | wheezy | package |
Примечания
http://bugzilla.maptools.org/show_bug.cgi?id=2563
Red Hat say it's only OOB read: https://bugzilla.redhat.com/show_bug.cgi?id=1294425#c1
Red Hat's patch is partially incorrect according to upstream
Issue was also marked as wontfix, because bmp2tiff utility has been removed
http://bugzilla.maptools.org/show_bug.cgi?id=2563#c4
Reproducer file here: http://bugzilla.maptools.org/attachment.cgi?id=677
bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
EPSS
Связанные уязвимости
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.
EPSS