CVE-2010-2595

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in
ImageMagick, does not properly handle invalid ReferenceBlackWhite values,
which allows remote attackers to cause a denial of service (application
crash) via a crafted TIFF image that triggers an array index error, related
to “downsampled OJPEG input.”

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=583081&gt;
• <http://bugzilla.maptools.org/show_bug.cgi?id=2208&gt;