CVE-2014-8127

Published: 31 December 2014

LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
tiff
Launchpad, Ubuntu, Debian 		Upstream Needs triage

Ubuntu 14.04 ESM (Trusty Tahr)
Released (4.0.3-7ubuntu0.2)
Patches:
Upstream: https://github.com/vadz/libtiff/commit/3996fa0f84f4a8b7e65fe4b8f0681711022034ea (2484)
Upstream: https://github.com/vadz/libtiff/commit/0782c759084daaf9e4de7ee6be7543081823455e (2485)
Upstream: https://github.com/vadz/libtiff/commit/662f74445b2fea2eeb759c6524661118aef567ca (2486)
Upstream: https://github.com/vadz/libtiff/commit/1f7359b00663804d96c3a102bcb6ead9812c1509 (2496 and 2497)

Notes

AuthorNote
mdeslaur 
usn-2553-1 didn't actually fix the issue in bug #2500 as no
patch was available at the time of publication. A future update
will include a patch for the issue.

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading