CVE-2010-2065: Buffer Overflow
Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.
Other sources
Sauli Pahlman of CERT-FI provided us with fuzzed TIFF file which crashes image viewers using libtiff library.
TIFF image triggers an integer overflow in TIFFroundup() macro called from TIFFFillStrip(). Sufficient large bytecount from the file can cause TIFFroundup() to return 0 and cause TIFFReadBufferSetup() to allocate an insufficiently-sized buffer. Later in TIFFReadRawStrip1(), application-provided read callback is called via TIFFReadFile() that possibly overflows the buffer.
This flaw occurs in libtiff 3.9.2, where bytecount in TIFFFillStrip() is defined as uint32. Older libtiff versions (e.g. those shipped with Red Hat Enterprise Linux 3, 4, and 5) use tsizet (signed int32) as its type and reject bytecount values that may lead to integer overflow earlier.
Issues was reported in launchpad (bug is currently restricted): https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/589565
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2065?
CVE-2010-2065 is classified as a high severity vulnerability due to its potential to cause denial of service and possibly allow remote code execution.
How do I fix CVE-2010-2065?
To fix CVE-2010-2065, update LibTIFF to version 3.9.3 or later.
What types of attacks can CVE-2010-2065 enable?
CVE-2010-2065 can enable remote attackers to execute arbitrary code or cause an application crash when processing crafted TIFF files.
Which versions of LibTIFF are affected by CVE-2010-2065?
LibTIFF versions prior to 3.9.3, including all versions 3.9.2 and below, are affected by CVE-2010-2065.
Who reported CVE-2010-2065?
CVE-2010-2065 was reported by Sauli Pahlman of CERT-FI.