medium
6.8
CWE
119 190
Advisory Published
CVE Published
Updated

CVE-2012-4564: Buffer Overflow

First published: Wed Oct 31 2012(Updated: )

A flaw was found in the way ppm2tiff, a tool to create a TIFF file from PPM, PGM and PBM image files, did not check the return value of TIFFScanlineSize() function. When TIFFScanlineSize encountered an integer-overflow and returned zero, this value was not checked. A remote attacker could provide a specially-crafted PPM image format file, that when processed by ppm2tiff would lead to ppm2tiff executable crash or, potentially, arbitrary code execution with the privileges of the user running the ppm2tiff binary.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
TIFF<=4.0.3
Debian Linux=6.0
Debian Linux=7.0
Ubuntu=8.04
Ubuntu=10.04
Ubuntu=11.10
Ubuntu=12.04
Ubuntu=12.10
Red Hat Enterprise Linux Desktop=5.0
Red Hat Enterprise Linux Desktop=6.0
Red Hat Enterprise Linux Server EUS=6.3
Red Hat Enterprise Linux Server=5.0
Red Hat Enterprise Linux Server=6.0
Red Hat Enterprise Linux Workstation=5.0
Red Hat Enterprise Linux Workstation=6.0
openSUSE=11.4

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=871700

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2012-4564?

    CVE-2012-4564 is considered a moderate severity vulnerability due to potential exploitation risks.

  • How do I fix CVE-2012-4564?

    To mitigate CVE-2012-4564, update the libtiff package to a version that is above 4.0.3.

  • What are the affected software versions for CVE-2012-4564?

    CVE-2012-4564 affects libtiff versions up to 4.0.3 and several versions of Debian and Ubuntu Linux.

  • Can CVE-2012-4564 be exploited remotely?

    Yes, CVE-2012-4564 can potentially be exploited by remote attackers through specially crafted image files.

  • What function is responsible for the vulnerability in CVE-2012-4564?

    The vulnerability in CVE-2012-4564 is due to improper handling of the return value from the TIFFScanlineSize() function.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203