CVE-2012-5581: Buffer Overflow
A stack-based buffer overflow was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code.
This issue is fixed in libtiff-4.0.2
Other sources
Stack-based buffer overflow in tifdir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5581?
CVE-2012-5581 has been categorized as a high severity vulnerability due to its potential for exploitation leading to application crashes or arbitrary code execution.
How do I fix CVE-2012-5581?
To fix CVE-2012-5581, update your libtiff library to version 4.0.2 or later, which addresses this buffer overflow vulnerability.
Who is affected by CVE-2012-5581?
CVE-2012-5581 affects multiple versions of libtiff, specifically versions prior to 4.0.2, including various 3.x and 4.x beta releases.
What kind of attack can CVE-2012-5581 facilitate?
CVE-2012-5581 can facilitate a remotely executed attack where a specially-crafted TIFF file causes an application using libtiff to crash or execute arbitrary code.
Which applications are impacted by CVE-2012-5581?
Any application that uses the vulnerable versions of the libtiff library for image processing tasks could be impacted by CVE-2012-5581.