The EstimateStripByteCounts function in TIFF library (libtiff) prior to 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent malicious users to cause a denial of service via a large td_nstrips value, which triggers an infinite loop.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
libtiff libtiff |