|Description||Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.|
|Source||CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)|
|NVD severity||high (attack range: remote)|
|Debian Bugs||706674, 712840|
|Debian/stable||package tiff3 is vulnerable. |
Vulnerable and fixed packages
The table below lists information on source packages.
|tiff (PTS)||squeeze (security), squeeze||3.9.4-5+squeeze10||fixed|
|wheezy, wheezy (security)||4.0.2-6+deb7u3||fixed|
The information above is based on the following data on fixed versions.
[wheezy] - tiff3 <no-dsa> (the changes that effect the library are just hardening, converting uses of sprintf to snprintf. those can be rolled into the next tiff3 update, but a separate dsa isn't needed)