CVE-2013-1961: Buffer Overflow
A stack-based buffer overflow was found in the way tiff2pdf, a TIFF image to a PDF document conversion tool, of libtiff, a library of functions for manipulating TIFF (Tagged Image File Format) image format files, performed write of TIFF image content into particular PDF document file, when malformed image-length and resolution values are used in the TIFF file. A remote attacker could provide a specially-crafted TIFF image format file, that when processed by tiff2pdf would lead to tiff2pdf executable crash.
Acknowledgements:
Red Hat would like to thank Emmanuel Bouillon (NCI Agency) for reporting this issue.
Other sources
Stack-based buffer overflow in the t2pwritepdfpage function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1961?
CVE-2013-1961 is classified as a high severity vulnerability due to the potential for remote code execution through crafted TIFF files.
How do I fix CVE-2013-1961?
To fix CVE-2013-1961, upgrade libtiff to version 4.0.4 or later.
What systems are affected by CVE-2013-1961?
CVE-2013-1961 affects multiple versions of libtiff including versions 3.4 through 4.0.3.
What types of attacks can exploit CVE-2013-1961?
CVE-2013-1961 can be exploited through specially crafted TIFF files leading to stack-based buffer overflow.
Is CVE-2013-1961 widely exploited in the wild?
As of now, there are no widespread reports of exploitation of CVE-2013-1961, but it remains a significant security concern.