CVE-2012-3401

Priority
Description
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF
4.0.2 and earlier does not properly initialize the T2P context struct
pointer in certain error conditions, which allows context-dependent
attackers to cause a denial of service (crash) and possibly execute
arbitrary code via a crafted TIFF image that triggers a heap-based buffer
overflow.
Assigned-to
mdeslaur
Notes
mdeslaurnot included in 4.0.2
tiff2pdf is not packaged in tiff3 in quantal
Package
Source: tiff (LP Ubuntu Debian)
Upstream:released (3.9.6-7)
Ubuntu 12.04 ESM (Precise Pangolin):released (4.0.2-1ubuntu2)
Package
Source: tiff3 (LP Ubuntu Debian)
Upstream:released (4.0.2-2)
Ubuntu 12.04 ESM (Precise Pangolin):not-affected (no binary)
More Information

Updated: 2020-03-18 22:09:38 UTC (commit 2ea7df7bd1e69e1e489978d2724a936eb3faa1b8)