Vulnerability CVE-2014-8127: Information
Description
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.
Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| libtiff | sisyphus | 4.0.10.0.57.f9fc01c3-alt1 | 4.4.0-alt4 | ALT-PU-2019-1628-1 | 226958 | Fixed |
| libtiff | p10 | 4.0.10.0.57.f9fc01c3-alt1 | 4.4.0-alt2 | ALT-PU-2019-1628-1 | 226958 | Fixed |
| libtiff | p9 | 4.0.10.0.57.f9fc01c3-alt1 | 4.0.10.0.57.f9fc01c3-alt1 | ALT-PU-2019-1628-1 | 226958 | Fixed |
| libtiff | c10f1 | 4.0.10.0.57.f9fc01c3-alt1 | 4.4.0-alt2 | ALT-PU-2019-1628-1 | 226958 | Fixed |
| libtiff | c9f2 | 4.0.10.0.57.f9fc01c3-alt1 | 4.3.0-alt1 | ALT-PU-2019-1628-1 | 226958 | Fixed |
| libtiff | p11 | 4.0.10.0.57.f9fc01c3-alt1 | 4.4.0-alt4 | ALT-PU-2019-1628-1 | 226958 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| [oss-security] 20150124 Multiple vulnerabilities in LibTIFF and associated tools |
|
| http://www.conostix.com/pub/adv/CVE-2014-8127-LibTIFF-Out-of-bounds_Reads.txt |
|
| openSUSE-SU-2015:0450 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2500 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2497 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2496 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2486 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2485 |
|
| http://bugzilla.maptools.org/show_bug.cgi?id=2484 |
|
| 72323 |
|
| GLSA-201701-16 | |
| 1032760 | |
| DSA-3273 | |
| RHSA-2016:1547 | |
| RHSA-2016:1546 |