CVE-2006-2193: Buffer Overflow
Buffer overflow in the t2pwritepdfstring function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2193?
CVE-2006-2193 has a medium severity rating due to its potential to cause denial of service and possibly allow remote code execution.
How do I fix CVE-2006-2193?
To fix CVE-2006-2193, upgrade to a version of libtiff later than 3.8.2 that has patched the buffer overflow vulnerability.
What are the potential impacts of CVE-2006-2193?
The potential impacts of CVE-2006-2193 include application crashes and the possibility of arbitrary code execution if an attacker provides a specially crafted TIFF file.
Which versions of libtiff are affected by CVE-2006-2193?
CVE-2006-2193 affects libtiff version 3.8.2 and earlier, as well as specific versions up to 3.8.1.
Is CVE-2006-2193 likely to be exploited?
While CVE-2006-2193 could be exploited, the actual risk depends on whether vulnerable software is used in an environment where TIFF files are being processed.