CVE-2012-4564: Buffer Overflow
A flaw was found in the way ppm2tiff, a tool to create a TIFF file from PPM, PGM and PBM image files, did not check the return value of TIFFScanlineSize() function. When TIFFScanlineSize encountered an integer-overflow and returned zero, this value was not checked. A remote attacker could provide a specially-crafted PPM image format file, that when processed by ppm2tiff would lead to ppm2tiff executable crash or, potentially, arbitrary code execution with the privileges of the user running the ppm2tiff binary.
Other sources
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4564?
CVE-2012-4564 is considered a moderate severity vulnerability due to potential exploitation risks.
How do I fix CVE-2012-4564?
To mitigate CVE-2012-4564, update the libtiff package to a version that is above 4.0.3.
What are the affected software versions for CVE-2012-4564?
CVE-2012-4564 affects libtiff versions up to 4.0.3 and several versions of Debian and Ubuntu Linux.
Can CVE-2012-4564 be exploited remotely?
Yes, CVE-2012-4564 can potentially be exploited by remote attackers through specially crafted image files.
What function is responsible for the vulnerability in CVE-2012-4564?
The vulnerability in CVE-2012-4564 is due to improper handling of the return value from the TIFFScanlineSize() function.