The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.

The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.

libtiff-devel-32bit-4.0.7-1.1 on GA media

libtiff: out-of-bounds read with malformed TIFF image in multiple tools libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf libtiff: divide by zero in the tiffdither tool libtiff: Out-of-bounds reads followed by a crash in bmp2tiff libtiff: use of uninitialized memory in putcontig8bitYCbCr21tile and NeXTDecode libtiff: use of uninitialized memory in NeXTDecode libtiff: Invalid-write in _TIFFVGetField() when parsing some extension tags libtiff: Out-of-bounds read in tif_getimage.c libtiff: OOB read in bmp2tiff libtiff: Out-of-bounds when reading CIE Lab image format files libtiff: invalid assertion libtiff: invalid assertion libtiff: invalid assertion libtiff: out-of-bound write in NeXTDecode() libtiff: out-of-bounds write in _TIFFVGetField function libtiff: out-of-bounds write in the tiff2rgba tool libtiff: out-of-bounds write in horizontalDifference8() libtiff: out-of-bounds write in loadImage() function libtiff: Out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c

Security update for tiff

Affected: Ubuntu:14.04:LTS: tiff

The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.