The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.

The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.

libtiff: out-of-bounds read with malformed TIFF image in multiple tools libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf libtiff: divide by zero in the tiffdither tool libtiff: Out-of-bounds reads followed by a crash in bmp2tiff libtiff: use of uninitialized memory in putcontig8bitYCbCr21tile and NeXTDecode libtiff: use of uninitialized memory in NeXTDecode libtiff: Invalid-write in _TIFFVGetField() when parsing some extension tags libtiff: Out-of-bounds read in tif_getimage.c libtiff: OOB read in bmp2tiff libtiff: Out-of-bounds when reading CIE Lab image format files libtiff: invalid assertion libtiff: invalid assertion libtiff: invalid assertion libtiff: out-of-bound write in NeXTDecode() libtiff: out-of-bounds write in _TIFFVGetField function libtiff: out-of-bounds write in the tiff2rgba tool libtiff: out-of-bounds write in horizontalDifference8() libtiff: out-of-bounds write in loadImage() function libtiff: Out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c

libtiff: out-of-bounds read with malformed TIFF image in multiple tools libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf libtiff: divide by zero in the tiffdither tool libtiff: Out-of-bounds reads followed by a crash in bmp2tiff libtiff: use of uninitialized memory in putcontig8bitYCbCr21tile and NeXTDecode libtiff: use of uninitialized memory in NeXTDecode libtiff: Invalid-write in _TIFFVGetField() when parsing some extension tags libtiff: Out-of-bounds read in tif_getimage.c libtiff: OOB read in bmp2tiff libtiff: Out-of-bounds when reading CIE Lab image format files libtiff: invalid assertion libtiff: invalid assertion libtiff: invalid assertion libtiff: out-of-bound write in NeXTDecode() libtiff: out-of-bounds write in _TIFFVGetField function libtiff: out-of-bounds write in the tiff2rgba tool libtiff: out-of-bounds write in horizontalDifference8() libtiff: out-of-bounds write in loadImage() function libtiff: Out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c

Security update for tiff

Affected: Ubuntu:14.04:LTS: tiff, Ubuntu:16.04:LTS: tiff

The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.