CVE-2005-2452: Medium severity LibTIFF libtiff vulnerability

Published Aug 3, 2005

Updated

libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tifstrip.c and (2) tiftile.c, a different vulnerability than CVE-2004-0804.

Affected Software

3 affected components

LibTIFF libtiff=3.6.1

LibTIFF libtiff=3.5.7

LibTIFF libtiff=3.5.5

Event History

Aug 3, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2452?

CVE-2005-2452 is classified as a denial of service vulnerability that can cause application crashes.

How do I fix CVE-2005-2452?

To fix CVE-2005-2452, users should update to a version of libtiff later than 3.7.0, which addresses the vulnerability.

Which versions of libtiff are affected by CVE-2005-2452?

CVE-2005-2452 affects libtiff versions up to and including 3.7.0.

What causes the vulnerability CVE-2005-2452?

The vulnerability occurs due to a divide-by-zero error triggered by a TIFF image header with a zero 'YCbCr subsampling' value.

Is CVE-2005-2452 related to any other vulnerabilities?

Yes, CVE-2005-2452 is a different issue than CVE-2004-0804, despite both being related to libtiff.