OSVDB ID: 10750 Title: LibTIFF RLE Image Decoding Multiple Local Overflows |
Info |
|
|
Dates |
||||
|
|
Description |
A local overflow exists in LibTIFF. LibTIFF fails to decode a specially crafted image resulting in a heap-based overflow during RLE decoding in tif_next.c and in tif_thunder.c. There may be heap-based overflows when doing RLE decoding in tif_luv.c. With a specially crafted image, an attacker can cause a buffer overflow resulting in a loss of integrity. |
Classification |
Location:
Local Access Required
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Upgrade to version 3.7.0beta2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
Credit |
|
scary.beasts.org -