|Description||Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||high (attack range: remote)|
|Debian Bugs||706674, 712840|
Vulnerable and fixed packages
The table below lists information on source packages.
|tiff (PTS)||wheezy (security), wheezy||4.0.2-6+deb7u5||fixed|
|jessie (security), jessie||4.0.3-12.3+deb8u1||fixed|
The information below is based on the following data on fixed versions.
[wheezy] - tiff3 <no-dsa> (the changes that effect the library are just hardening, converting uses of sprintf to snprintf. those can be rolled into the next tiff3 update, but a separate dsa isn't needed)