CVE-2014-8128
Published: 31 December 2014
LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
Notes
| Author | Note |
|---|---|
| mdeslaur | bug 2499 is in Debian patch called CVE-2014-8128-5.patch CVE-2014-8128-5.patch caused a regression and was backed out of USN-2553-2. See LP: #1439186 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
tiff Launchpad, Ubuntu, Debian |
lucid |
Released
(3.9.2-2ubuntu0.15)
|
| precise |
Released
(3.9.5-2ubuntu1.7)
|
|
| trusty |
Released
(4.0.3-7ubuntu0.2)
|
|
| upstream |
Needs triage
|
|
| utopic |
Released
(4.0.3-10ubuntu0.1)
|
|
|
Patches: upstream: https://github.com/vadz/libtiff/commit/3206e0c752a62da1ae606867113ed3bf9bf73306 upstream: https://github.com/vadz/libtiff/commit/cd82b5267ad4c10eb91e4ee8a716a81362cf851c upstream: https://github.com/vadz/libtiff/commit/8b6e80fca434525497e5a31c3309a3bab5b3c1c8 upstream: https://github.com/vadz/libtiff/commit/662f74445b2fea2eeb759c6524661118aef567ca upstream: https://github.com/vadz/libtiff/commit/266bc48054b018a2f1d74562aa48eb2f509436d5 upstream: https://github.com/vadz/libtiff/commit/147b2698c84004fe2da93c0fc7177a7c3797533d |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References
- http://www.conostix.com/pub/adv/CVE-2014-8128-LibTIFF-Out-of-bounds_Writes.txt
- https://ubuntu.com/security/notices/USN-2553-1
- https://www.cve.org/CVERecord?id=CVE-2014-8128
- NVD
- Launchpad
- Debian
Bugs
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776185
- http://bugzilla.maptools.org/show_bug.cgi?id=2489 (thumbnail)
- http://bugzilla.maptools.org/show_bug.cgi?id=2490 (tiffdither)
- http://bugzilla.maptools.org/show_bug.cgi?id=2491 (tiffdither)
- http://bugzilla.maptools.org/show_bug.cgi?id=2492 (tiffdither)
- http://bugzilla.maptools.org/show_bug.cgi?id=2493 (thumbnail and tiffcmp)
- http://bugzilla.maptools.org/show_bug.cgi?id=2495 (tiff2pdf)
- http://bugzilla.maptools.org/show_bug.cgi?id=2499 (thumbnail and tiffcmp) [not fixed yet in CVS HEAD]
- http://bugzilla.maptools.org/show_bug.cgi?id=2501 (tiffdither)
- https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/1439186