ID CVE-2012-4564
Summary ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
References
Vulnerable Configurations
  • LibTIFF
    cpe:2.3:a:libtiff:libtiff
CVSS
Base: 6.8 (as of 12-11-2012 - 17:04)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201402-21.NASL
    description The remote host is affected by the vulnerability described in GLSA-201402-21 (libTIFF: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libTIFF. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted TIFF file with an application making use of libTIFF, possibly resulting in execution of arbitrary code with the privileges of the user running the application or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 72635
    published 2014-02-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72635
    title GLSA-201402-21 : libTIFF: Multiple vulnerabilities
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2013-290-01.NASL
    description New libtiff packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.
    last seen 2019-02-21
    modified 2013-10-22
    plugin id 70499
    published 2013-10-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70499
    title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : libtiff (SSA:2013-290-01)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2575.NASL
    description It was discovered that ppm2tiff of the TIFF tools, a set of utilities for TIFF manipulation and conversion, is not properly checking the return value of an internal function used in order to detect integer overflows. As a consequence, ppm2tiff suffers of a heap-based buffer overflow. This allows attacker to potentially execute arbitrary code via a crafted PPM image, especially in scenarios in which images are automatically processed.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 62949
    published 2012-11-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62949
    title Debian DSA-2575-1 : tiff - heap-based buffer overflow
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_GIMP_20130521.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow. (CVE-2012-4564)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80623
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80623
    title Oracle Solaris Third-Party Patch Update : gimp (cve_2012_4564_design_error)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_LIBTIFF-DEVEL-130109.NASL
    description Various memory corruption vulnerabilities have been fixed in libtiff. CVE-2012-4447 / CVE-2012-4564 / CVE-2012-5581 have been assigned to these issues.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 64199
    published 2013-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64199
    title SuSE 11.2 Security Update : libtiff (SAT Patch Number 7216)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1631-1.NASL
    description It was discovered that LibTIFF incorrectly handled certain malformed images using the PixarLog compression format. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2012-4447) Huzaifa S. Sidhpurwala discovered that the ppm2tiff tool incorrectly handled certain malformed PPM images. If a user or automated system were tricked into opening a specially crafted PPM image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2012-4564). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 62936
    published 2012-11-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62936
    title Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : tiff vulnerabilities (USN-1631-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-1590.NASL
    description Updated libtiff packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564) The CVE-2012-5581, CVE-2012-3401, and CVE-2012-4564 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team. All libtiff users should upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 63306
    published 2012-12-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63306
    title CentOS 5 / 6 : libtiff (CESA-2012:1590)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-1590.NASL
    description Updated libtiff packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564) The CVE-2012-5581, CVE-2012-3401, and CVE-2012-4564 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team. All libtiff users should upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 63293
    published 2012-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63293
    title RHEL 5 / 6 : libtiff (RHSA-2012:1590)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-20404.NASL
    description - Update to libtiff 3.9.7 (includes previously-added security fixes) - Add patches for CVE-2012-4447, CVE-2012-4564, CVE-2012-5581 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-09
    plugin id 63362
    published 2012-12-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63362
    title Fedora 16 : libtiff-3.9.7-1.fc16 (2012-20404)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-1590.NASL
    description From Red Hat Security Advisory 2012:1590 : Updated libtiff packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564) The CVE-2012-5581, CVE-2012-3401, and CVE-2012-4564 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team. All libtiff users should upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68667
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68667
    title Oracle Linux 5 / 6 : libtiff (ELSA-2012-1590)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2012-147.NASL
    description A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69637
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69637
    title Amazon Linux AMI : libtiff (ALAS-2012-147)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-20348.NASL
    description Add upstream patches for CVE-2012-4447, CVE-2012-4564 (note: CVE-2012-5581 is already fixed in 4.0.3) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-09
    plugin id 63493
    published 2013-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63493
    title Fedora 18 : libtiff-4.0.3-2.fc18 (2012-20348)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-20446.NASL
    description - Update to libtiff 3.9.7 (includes previously-added security fixes) - Add patches for CVE-2012-4447, CVE-2012-4564, CVE-2012-5581 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-09
    plugin id 63363
    published 2012-12-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63363
    title Fedora 17 : libtiff-3.9.7-1.fc17 (2012-20446)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2012-174.NASL
    description Multiple vulnerabilities was found and corrected in libtiff : Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format (CVE-2012-4447). ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow (CVE-2012-4564). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 63017
    published 2012-11-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63017
    title Mandriva Linux Security Advisory : libtiff (MDVSA-2012:174)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20121218_LIBTIFF_ON_SL5_X.NASL
    description A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564) All running applications linked against libtiff must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 63314
    published 2012-12-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63314
    title Scientific Linux Security Update : libtiff on SL5.x, SL6.x i386/x86_64
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-046.NASL
    description Updated libtiff packages fix security vulnerabilities : libtiff did not properly convert between signed and unsigned integer values, leading to a buffer overflow. An attacker could use this flaw to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code (CVE-2012-2088). Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code (CVE-2012-2113). Huzaifa Sidhpurwala discovered that the tiff2pdf utility incorrectly handled certain malformed TIFF images. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges (CVE-2012-3401). It was discovered that a buffer overflow in libtiff's parsing of files using PixarLog compression could lead to the execution of arbitrary code (CVE-2012-4447). ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow (CVE-2012-4564). It was discovered that LibTIFF incorrectly handled certain malformed images using the DOTRANGE tag. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges (CVE-2012-5581).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 66060
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66060
    title Mandriva Linux Security Advisory : libtiff (MDVSA-2013:046)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_LIBTIFF_20131217.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow. (CVE-2012-4564) - Heap-based buffer overflow in the t2p_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file. (CVE-2013-1960) - Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file. (CVE-2013-1961)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80681
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80681
    title Oracle Solaris Third-Party Patch Update : libtiff (cve_2012_4564_design_error1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_LIBTIFF-8419.NASL
    description Various memory corruption vulnerabilities have been fixed in libtiff. CVE-2012-4447 / CVE-2012-4564 / CVE-2012-5581 have been assigned to these issues.
    last seen 2019-02-21
    modified 2013-02-25
    plugin id 64093
    published 2013-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64093
    title SuSE 10 Security Update : libtiff (ZYPP Patch Number 8419)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-29.NASL
    description This update of tiff fixed a heap-based buffer overflow vulnerability and an integer overflow issue.
    last seen 2019-02-21
    modified 2014-06-13
    plugin id 74956
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74956
    title openSUSE Security Update : tiff (openSUSE-2013-29)
redhat via4
advisories
rhsa
id RHSA-2012:1590
rpms
  • libtiff-0:3.8.2-18.el5_8
  • libtiff-devel-0:3.8.2-18.el5_8
  • libtiff-0:3.9.4-9.el6_3
  • libtiff-devel-0:3.9.4-9.el6_3
  • libtiff-static-0:3.9.4-9.el6_3
refmap via4
bid 56372
confirm https://bugzilla.redhat.com/show_bug.cgi?id=871700
debian DSA-2575
mlist
  • [oss-security] 20121102 Re: libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file
  • [oss-security] 20121102 libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file
osvdb 86878
secunia 51133
suse openSUSE-SU-2013:0187
ubuntu USN-1631-1
xf libtiff-ppm2tiff-bo(79750)
Last major update 07-02-2013 - 23:54
Published 11-11-2012 - 08:00
Last modified 28-08-2017 - 21:32
Back to Top