Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and previous versions allows malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
libtiff libtiff 3.4 |
||
libtiff libtiff 3.5.7 |
||
libtiff libtiff 3.6.0 |
||
libtiff libtiff 3.5.1 |
||
libtiff libtiff 3.5.2 |
||
libtiff libtiff 3.6.1 |
||
libtiff libtiff 3.7.0 |
||
libtiff libtiff 3.5.5 |
||
libtiff libtiff 3.5.6 |
||
libtiff libtiff 3.8.1 |
||
libtiff libtiff |
||
libtiff libtiff 3.5.3 |
||
libtiff libtiff 3.5.4 |
||
libtiff libtiff 3.7.1 |
||
libtiff libtiff 3.8.0 |
Vulmon