CVE-2010-2597

Published: 2 July 2010

The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error.

Status

References

• https://ubuntu.com/security/notices/USN-1085-1
• https://www.cve.org/CVERecord?id=CVE-2010-2597
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2597
• https://bugzilla.redhat.com/show_bug.cgi?id=603703
• https://bugs.launchpad.net/bugs/593067
• http://bugzilla.maptools.org/show_bug.cgi?id=2215