Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote malicious users to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
libtiff libtiff 3.4 |
||
libtiff libtiff 3.6.0 |
||
libtiff libtiff 3.6.1 |
||
libtiff libtiff 3.7.0 |
||
libtiff libtiff 3.5.3 |
||
libtiff libtiff 3.5.4 |
||
libtiff libtiff 3.5.5 |
||
libtiff libtiff 3.5.7 |
||
libtiff libtiff 3.5.1 |
||
libtiff libtiff 3.5.2 |