Описание
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
Отчет
This vulnerability is classified as having a Moderate impact because exploitation is restricted to the standalone tiff2pdf conversion utility and requires an attacker to convince a user or automated pipeline to process a specially crafted BigTIFF image. Core shared libraries in libtiff and standard Red Hat Enterprise Linux system services do not expose this functionality over the network by default. While memory corruption or denial of service through an application crash can occur, the blast radius is strictly limited to the privileges of the local process executing the tool.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 4 | ceph | Not affected | ||
| Red Hat Ceph Storage 6 | ceph | Not affected | ||
| Red Hat Ceph Storage 7 | ceph | Not affected | ||
| Red Hat Ceph Storage 8 | ceph | Not affected | ||
| Red Hat Ceph Storage 9 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | boost | Not affected | ||
| Red Hat Enterprise Linux 10 | ceph | Not affected | ||
| Red Hat Enterprise Linux 10 | libtiff | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libtiff | Out of support scope | ||
| Red Hat Enterprise Linux 7 | compat-libtiff3 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
A flaw was found in libtiff. A heap-buffer overflow vulnerability exis ...
EPSS
6.1 Medium
CVSS3