Remote Code Execution (RCE)

libtiff.so is vulnerable to remote code execution RCE attacks. A malicious user can pass a tiff file to the TIFFGetField function in tifdir.c that can lead to a type confusion, crashing the application or potentially causing arbitrary code to be executed...

Input validation

The TIFFVStripSize function in tifstrip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service application crash via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler...