CVE-2009-2347: Buffer Overflow
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvtwholeimage function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2347?
CVE-2009-2347 is classified as high severity due to the potential for arbitrary code execution by attackers.
How do I fix CVE-2009-2347?
To fix CVE-2009-2347, update libtiff to version 4.0 or later, or apply any relevant patches provided by your vendor.
What types of software are affected by CVE-2009-2347?
CVE-2009-2347 affects libtiff versions 3.8.0 through 3.8.2, 3.9, and 4.0.
What are the attack vectors for CVE-2009-2347?
The attack vector for CVE-2009-2347 involves using specially crafted TIFF images with large width and height values.
Can CVE-2009-2347 lead to data breaches?
Yes, CVE-2009-2347 could potentially lead to data breaches if exploited, as it allows for arbitrary code execution.