tiff -- directory entry count integer overflow vulnerability

Description:

In an iDEFENSE Security Advisory infamous41md reports:

Remote exploitation of a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code.

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. A TIFF file includes a number of directory entry header fields that describe the data in the file. Included in these entries is an entry count and offset value that are calculated to determine the size and location of the data for that entry.

References:

• BugTraq ID 12075
• CVE name CVE-2004-1308
• URL: <http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities>
• CERT vulnerability note 125598

Affects:

• tiff <3.7.1
• linux-tiff <3.6.1_1
• pdflib <6.0.1_1
• pdflib-perl <6.0.1_1
• gdal <1.2.1_2
• ivtools <1.2.3
• paraview <2.4.3
• fractorama <1.6.7_1
• iv >0
• ja-iv >0
• ja-libimg >0

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Officer. Refer to "FreeBSD Security Information" for more information.