Vulnerability Note VU#555304
LibTIFF vulnerable to denial-of-service condition
An Integer overflow in the LibTIFF library may allow a remote attacker to cause a divide-by-zero error that results in a denial-of-service condition.
LibTIFF is a library used to encode and decode images in Tag Image File Format (TIFF) format. An integer overflow in the tif_dirread.c file may allow an attacker to cause a divide-by-zero error. If a remote attacker can persuade a user to access a specially crafted TIFF image with the row bytes field set to zero, that attacker may cause the divide-by-zero error and crash the process that linked to the LibTIFF library.
Any program that uses the LibTIFF library may be affected by this issue. Users are encouraged to contact their vendors to determine if they are vulnerable.
A remote attacker may be able to cause a divide-by-zero error and crash the process linked to the LibTIFF library.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|NEC Corporation||Not Affected||01 Nov 2004||17 Mar 2005|
|Apple Computer Inc.||Unknown||01 Nov 2004||17 May 2005|
|BSDI||Unknown||-||01 Nov 2004|
|Conectiva||Unknown||-||01 Nov 2004|
|Cray Inc.||Unknown||-||01 Nov 2004|
|Debian||Unknown||01 Nov 2004||02 Nov 2004|
|EMC Corporation||Unknown||-||01 Nov 2004|
|Engarde||Unknown||-||01 Nov 2004|
|F5 Networks||Unknown||-||01 Nov 2004|
|FreeBSD||Unknown||-||01 Nov 2004|
|Fujitsu||Unknown||-||01 Nov 2004|
|Hewlett-Packard Company||Unknown||-||01 Nov 2004|
|Hitachi||Unknown||-||01 Nov 2004|
|IBM||Unknown||-||01 Nov 2004|
|IBM-zSeries||Unknown||-||01 Nov 2004|
CVSS Metrics (Learn More)
This vulnerability was reported in Secunia Security Advisory SA12818.
Secunia credits Chris Evans and Dmitry V. Levin for providing information regarding this vulnerability.
This document was written by Jeff Gennari.
- CVE IDs: CAN-2004-0804
- Date Public: 25 Aug 2004
- Date First Published: 01 Dec 2004
- Date Last Updated: 17 May 2005
- Severity Metric: 0.69
- Document Revision: 79
If you have feedback, comments, or additional information about this vulnerability, please send us email.