CVE-2013-4232: Use After Free
Pedro Ribeiro discovered a use-after-free flaw in the t2preadwritepdfimage() function in tiff2pdf, a tool for converting a TIFF image to a PDF document. A remote attacker could provide a specially-crafted TIFF file that, when processed by tiff2pdf, would cause tiff2pdf to crash or, potentially, execute arbitrary code with the privileges of the user running tiff2pdf.
References:
http://www.asmail.be/msg0055359936.html http://www.openwall.com/lists/oss-security/2013/08/08/6
Other sources
Use-after-free vulnerability in the t2preadwritepdfimage function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4232?
CVE-2013-4232 is classified as a high severity vulnerability due to its potential for remote code execution.
How can I mitigate CVE-2013-4232?
To mitigate CVE-2013-4232, ensure that you update to a patched version of libtiff that resolves the use-after-free flaw.
Which versions of libtiff are affected by CVE-2013-4232?
CVE-2013-4232 affects libtiff version 4.0.3 and potentially earlier versions.
What type of attack does CVE-2013-4232 facilitate?
CVE-2013-4232 allows a remote attacker to crash the tiff2pdf utility or execute arbitrary code via a specially crafted TIFF file.
Is CVE-2013-4232 specific to any operating system?
Yes, CVE-2013-4232 has been reported in Debian GNU/Linux 6.0 and 7.0 installations using the affected libtiff version.