Remote Yes

Type Information disclosure

Description

A heap-based out-of-bounds read has been found in libtiff before 4.0.10, in the TIFFWriteScanline() function. The issue is caused by a uint32_t overflow on 32-bit systems.

AVG-816 libtiff 4.0.9-1 4.0.10-1 Medium Not affected FS#60599

AVG-791 lib32-libtiff 4.0.9-1 4.0.10-1 High Fixed FS#60599

20 Nov 2018 ASA-201811-18 AVG-791 lib32-libtiff High multiple issues

http://bugzilla.maptools.org/show_bug.cgi?id=2788
https://gitlab.com/libtiff/libtiff/commit/981e43ecae83935625c86c9118c0778c942c7048