CVE-2012-1173

Published: 4 April 2012

Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.

Priority

Status

Package	Release	Status
tiff Launchpad, Ubuntu, Debian	hardy	Released (3.8.2-7ubuntu3.10)
	lucid	Released (3.9.2-2ubuntu0.8)
	maverick	Released (3.9.4-2ubuntu0.5)
	natty	Released (3.9.4-5ubuntu6.1)
	oneiric	Released (3.9.5-1ubuntu1.1)
	upstream	Needs triage

References

http://home.gdal.org/private/zdi-can-1221/zdi-can-1221.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1173
https://ubuntu.com/security/notices/USN-1416-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›