Veracode Vulnerability DatabaseVERACODE:6320Denial Of Service (DoS)
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
libtiff.so is vulnerable to denial of service (DoS) attacks. The library fails to verify BitsPerSample in a given tiff file, allowing a malicious user to pass a tiff file to the application to cause an out-of-bounds write that can lead to code being executed or the application crashing.
References
bugzilla.maptools.org/show_bug.cgi?id=2487
bugzilla.maptools.org/show_bug.cgi?id=2488
lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
openwall.com/lists/oss-security/2015/01/24/15
rhn.redhat.com/errata/RHSA-2016-1546.html
rhn.redhat.com/errata/RHSA-2016-1547.html
support.apple.com/kb/HT204941
support.apple.com/kb/HT204942
www.conostix.com/pub/adv/CVE-2014-8129-LibTIFF-Out-of-bounds_Reads_and_Writes.txt
www.securityfocus.com/bid/72352
www.securitytracker.com/id/1032760
access.redhat.com/errata/RHSA-2016:1546
access.redhat.com/errata/RHSA-2016:1547
access.redhat.com/security/cve/CVE-2014-8129
bugzilla.redhat.com/show_bug.cgi?id=1185815
github.com/vadz/libtiff/commit/cd82b5267ad4c10eb91e4ee8a716a81362cf851c
security.gentoo.org/glsa/201701-16
www.debian.org/security/2015/dsa-3273
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P