CVE-2013-1960: Buffer Overflow
A heap-based buffer overflow flaw was found in the way tiff2pdf, a TIFF image to a PDF document conversion tool, of libtiff, a library of functions for manipulating TIFF (Tagged Image File Format) image format files, performed write of TIFF image content into particular PDF document file, in the tpprocessjpegstrip() function. A remote attacker could provide a specially-crafted TIFF image format file, that when processed by tiff2pdf would lead to tiff2pdf executable crash or, potentially, arbitrary code execution with the privileges of the user running the tiff2pdf binary.
Acknowledgements:
Red Hat would like to thank Emmanuel Bouillon (NCI Agency) for reporting this issue.
Other sources
Heap-based buffer overflow in the t2pprocessjpegstrip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1960?
CVE-2013-1960 is classified as a high-severity vulnerability due to its potential to cause a heap-based buffer overflow.
How do I fix CVE-2013-1960?
To fix CVE-2013-1960, upgrade to a version of libtiff that is higher than 4.0.3 or apply the relevant patches provided by the maintainers.
What software is affected by CVE-2013-1960?
CVE-2013-1960 affects multiple versions of libtiff, specifically versions up to and including 4.0.3 and various 3.4 versions.
What can happen if CVE-2013-1960 is exploited?
Exploiting CVE-2013-1960 can lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system.
Is there a workaround for CVE-2013-1960?
There are no known effective workarounds for CVE-2013-1960, so upgrading to a patched version is strongly recommended.