Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • aports aports
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 720
    • Issues 720
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 332
    • Merge requests 332
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • alpine
  • aportsaports
  • Issues
  • #2203
Closed
Open
Created Aug 06, 2013 by Peter Kotcauer@kocka

Multiple security issues in libtiff (CVE-2013-1960 , CVE-2013-1961)

references:
https://access.redhat.com/security/cve/CVE-2013-1960
https://access.redhat.com/security/cve/CVE-2013-1961

Two flaws were reported to us in tiff2pdf utility shipped with the
libtiff library. Details as follows:

  1. CVE-2013-1961 libtiff (tiff2pdf): Stack-based buffer overflow with
    malformed image-length and resolution

A stack-based buffer overflow was found in the way tiff2pdf, a TIFF
image to a PDF document conversion tool, of libtiff, a library of
functions for manipulating TIFF (Tagged Image File Format) image format
files, performed write of TIFF image content into particular PDF
document file, when malformed image-length and resolution values are
used in the TIFF file. A remote attacker could provide a specially-
crafted TIFF image format file, that when processed by tiff2pdf would
lead to tiff2pdf executable crash.

Reference: https://bugzilla.redhat.com/show\_bug.cgi?id=952131

  1. CVE-2013-1960 libtiff (tiff2pdf): Heap-based buffer overflow in
    t2_process_jpeg_strip()

A heap-based buffer overflow flaw was found in the way tiff2pdf, a TIFF
image to a PDF document conversion tool, of libtiff, a library of
functions for manipulating TIFF (Tagged Image File Format) image format
files, performed write of TIFF image content into particular PDF
document file, in the tp_process_jpeg_strip() function. A remote
attacker could provide a specially-crafted TIFF image format file, that
when processed by tiff2pdf would lead to tiff2pdf executable crash or,
potentially, arbitrary code execution with the privileges of the user
running the tiff2pdf binary.

Reference: https://bugzilla.redhat.com/show\_bug.cgi?id=952158

(from redmine: issue id 2203, created on 2013-08-06, closed on 2013-08-29)

  • Relations:
    • child #2204 (closed)
    • child #2205 (closed)
    • child #2206 (closed)
    • child #2207 (closed)
    • child #2208 (closed)
  • Changesets:
    • Revision c14e8873 by Natanael Copa on 2013-08-07T14:21:11Z:
main/tiff: sec fixes from upstream (CVE-2012-4447,CVE-2012-4564,CVE-2013-1960,CVE-2013-1961)

ref #2203
fixes #2204
  • Revision 844b74d9 by Natanael Copa on 2013-08-07T14:24:10Z:
main/tiff: sec fixes (CVE-2012-4447,CVE-2012-4564,CVE-2013-1960,CVE-2013-1961)

ref #2203
fixes #2205
  • Revision 86317251 by Natanael Copa on 2013-08-07T14:26:50Z:
main/tiff: sec fixes from upstream (CVE-2012-4447,CVE-2012-4564,CVE-2013-1960,CVE-2013-1961)

ref #2203
fixes #2206
  • Revision 0b6330a1 by Natanael Copa on 2013-08-07T14:35:19Z:
main/tiff: sec fixes from upstream (CVE-2013-1960,CVE-2013-1961)

ref #2203
fixes #2207
  • Revision a3d144a3 by Natanael Copa on 2013-08-07T15:51:08Z:
main/tiff: sec fixes from upstream (CVE-2013-1960,CVE-2013-1961)

ref #2203
fixes #2208
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking