ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.

ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.

libtiff-devel-32bit-4.0.7-1.1 on GA media

(tiff2pdf): Heap-based buffer overflow due to improper initialization of T2P context struct pointer libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file libtiff: Stack-based buffer overflow when reading a tiled tiff file