CVE-2014-8127

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8127
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://bugzilla.maptools.org/show_bug.cgi?id=2484 Issue Tracking
http://bugzilla.maptools.org/show_bug.cgi?id=2485 Issue Tracking
http://bugzilla.maptools.org/show_bug.cgi?id=2486 Issue Tracking
http://bugzilla.maptools.org/show_bug.cgi?id=2496 Issue Tracking
http://bugzilla.maptools.org/show_bug.cgi?id=2497 Issue Tracking
http://bugzilla.maptools.org/show_bug.cgi?id=2500 Issue Tracking
http://lists.opensuse.org/opensuse-updates/2015-03/msg00022.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1546.html
http://rhn.redhat.com/errata/RHSA-2016-1547.html
http://www.conostix.com/pub/adv/CVE-2014-8127-LibTIFF-Out-of-bounds_Reads.txt Third Party Advisory
http://www.debian.org/security/2015/dsa-3273
http://www.openwall.com/lists/oss-security/2015/01/24/15 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/72323 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032760
https://security.gentoo.org/glsa/201701-16
Configurations

Configuration 1 (hide)

cpe:2.3:a:libtiff:libtiff:4.0.3:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
History

13 Feb 2023, 00:43

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1547', 'name': 'https://access.redhat.com/errata/RHSA-2016:1547', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1185805', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1185805', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1546', 'name': 'https://access.redhat.com/errata/RHSA-2016:1546', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-8127', 'name': 'https://access.redhat.com/security/cve/CVE-2014-8127', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2014-8127 libtiff: out-of-bounds read with malformed TIFF image in multiple tools LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.

02 Feb 2023, 16:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1547 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1185805 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1546 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-8127 -
Summary LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. CVE-2014-8127 libtiff: out-of-bounds read with malformed TIFF image in multiple tools
Information

Published : 2017-06-26 15:29

Updated : 2023-12-10 12:15

NVD link : CVE-2014-8127

Mitre link : CVE-2014-8127

CVE.ORG link : CVE-2014-8127

JSON object : View

Products Affected

opensuse

  • opensuse

libtiff

  • libtiff
CWE
CWE-125

Out-of-bounds Read