A null pointer dereference issue was found in Libtiff's tifdirinfo.c file. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or just injecting faults, which would cause segmentation fault. This may cause an application crash, eventually leading to a denial of service.
References: https://gitlab.com/libtiff/libtiff/-/mergerequests/559 https://gitlab.com/libtiff/libtiff/-/issues/624
A flaw was found in the libtiff library. An out-of-memory issue in the TIFFReadEncodedStrip function can be triggered when processing a crafted tiff file, allowing attackers to perform memory allocation of arbitrary sizes, resulting in a denial of service.
Reference: https://gitlab.com/libtiff/libtiff/-/issues/620
Upstream patch: https://gitlab.com/libtiff/libtiff/-/mergerequests/553
A flaw was found in the libtiff library. An out-of-memory issue in the TIFFReadEncodedStrip function can be triggered when processing a crafted tiff file, allowing attackers to perform memory allocation of arbitrary sizes, resulting in a denial of service.
Reference: https://gitlab.com/libtiff/libtiff/-/issues/620
Upstream patch: https://gitlab.com/libtiff/libtiff/-/mergerequests/553
An issue was found in the tiffcp utility distributed by the libtiff package. Processing a crafted TIFF file may cause a heap-based buffer overflow, resulting in an application crash.
Reference: https://gitlab.com/libtiff/libtiff/-/issues/606
libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.
https://gitlab.com/libtiff/libtiff/-/issues/520 https://gitlab.com/libtiff/libtiff/-/mergerequests/467
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
References: https://gitlab.com/libtiff/libtiff/-/issues/277 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4645.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
References: https://gitlab.com/libtiff/libtiff/-/issues/497 https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0804.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
References: https://gitlab.com/libtiff/libtiff/-/issues/501 https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0803.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
References: https://gitlab.com/libtiff/libtiff/-/issues/500 https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0802.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tifunix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
References: https://gitlab.com/libtiff/libtiff/-/issues/498 https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0801.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
References: https://gitlab.com/libtiff/libtiff/-/issues/496 https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0800.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.
https://gitlab.com/libtiff/libtiff/-/issues/488 https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5
It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tifclose.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input.
Upstream bug:
https://gitlab.com/libtiff/libtiff/-/issues/422
Upstream fix:
https://gitlab.com/libtiff/libtiff/-/mergerequests/378
A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.
Upstream bug:
https://gitlab.com/libtiff/libtiff/-/issues/424
Upstream fix:
https://gitlab.com/libtiff/libtiff/-/mergerequests/378
There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
Upstream issue:
https://gitlab.com/libtiff/libtiff/-/issues/423
Upstream fix:
https://gitlab.com/libtiff/libtiff/-/mergerequests/378
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2058.json https://gitlab.com/libtiff/libtiff/-/mergerequests/346 https://gitlab.com/libtiff/libtiff/-/issues/428
A stack-buffer-overflow flaw was found in tiffcp.c in main()
References: https://gitlab.com/libtiff/libtiff/-/issues/400 https://gitlab.com/libtiff/libtiff/-/mergerequests/323
A heap-buffer-overflow flaw was found in TIFFReadRawDataStriped() function in tiffinfo.c.
References: https://gitlab.com/libtiff/libtiff/-/issues/319 https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources.
Upstream fix: https://gitlab.com/libtiff/libtiff/-/mergerequests/306
Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
https://gitlab.com/libtiff/libtiff/-/mergerequests/311 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0924.json https://gitlab.com/libtiff/libtiff/-/issues/278
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tifdirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0908.json https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85 https://gitlab.com/libtiff/libtiff/-/issues/383
Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
https://gitlab.com/libtiff/libtiff/-/mergerequests/310 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0909.json
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0562.json
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json
LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Reference: https://gitlab.com/libtiff/libtiff/-/issues/355
Upstream patch: https://gitlab.com/libtiff/libtiff/-/mergerequests/287
DISPUTED LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tifopen.c, tiflzw.c, and tifaux.c. NOTE: Third parties were unable to reproduce the issue.
An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tiflzw.c.
References: http://bugzilla.maptools.org/showbug.cgi?id=2819
Upstream Patch: https://gitlab.com/libtiff/libtiff/commit/99b10edde9a0fc28cc0e7b7757aa18ac4c8c225f
LibTIFF 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tifjbig.c JBIGDecode out-of-bounds write.
Upstream MR:
https://gitlab.com/libtiff/libtiff/mergerequests/38
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1697
The function t2pwritepdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935.
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
Upstream issue:
http://bugzilla.maptools.org/showbug.cgi?id=2807
Upstream patch:
https://gitlab.com/libtiff/libtiff/mergerequests/33/diffs?commitid=f1b94e8a3ba49febdd3361c0214a1d1149251577