CVE-2012-3401
- State
- Published
- Severity
- Not scored
- Published
- Aug 13, 2012
- Updated
- Aug 6, 2024
- Reserved
- Jun 14, 2012
Description
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=837577
- openSUSE-SU-2012:0955vendor-advisory
- [oss-security] 20120719 tiff2pdf: Heap-based buffer overflow due to improper initialization of T2P context struct pointermailing-list
- http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830
- 54601vdb-entry
- [oss-security] 20120719 Re: tiff2pdf: Heap-based buffer overflow due to improper initialization of T2P context struct pointermailing-list
- DSA-2552vendor-advisory
- 49938third-party-advisory
- 50007third-party-advisory
- USN-1511-1vendor-advisory
- GLSA-201209-02vendor-advisory
- 84090vdb-entry
- libtiff-t2preadtiffinit-bo(77088)vdb-entry
- https://bugzilla.redhat.com/attachment.cgi?id=596457
- MDVSA-2012:127vendor-advisory
- RHSA-2012:1590vendor-advisory
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
- 50726third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.