CVE-2009-5022

Published: May 3, 2011Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.

Affected (47)

Products: Libtiff: Libtiff

1 product

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Up to 3.9.4
Libtiff Libtiff	Version 3.4
Libtiff Libtiff	Version 3.4 beta18
Libtiff Libtiff	Version 3.4 beta24
Libtiff Libtiff	Version 3.4 beta28
Libtiff Libtiff	Version 3.4 beta29
Libtiff Libtiff	Version 3.4 beta31
Libtiff Libtiff	Version 3.4 beta32
Libtiff Libtiff	Version 3.4 beta34
Libtiff Libtiff	Version 3.4 beta35
Libtiff Libtiff	Version 3.4 beta36
Libtiff Libtiff	Version 3.4 beta37
Libtiff Libtiff	Version 3.5.1
Libtiff Libtiff	Version 3.5.2
Libtiff Libtiff	Version 3.5.3
Libtiff Libtiff	Version 3.5.4
Libtiff Libtiff	Version 3.5.5
Libtiff Libtiff	Version 3.5.6
Libtiff Libtiff	Version 3.5.6 beta
Libtiff Libtiff	Version 3.5.7
Libtiff Libtiff	Version 3.5.7 alpha2
Libtiff Libtiff	Version 3.5.7 alpha3
Libtiff Libtiff	Version 3.5.7 alpha4
Libtiff Libtiff	Version 3.5.7 alpha
Libtiff Libtiff	Version 3.5.7 beta
Libtiff Libtiff	Version 3.6.0
Libtiff Libtiff	Version 3.6.0 beta2
Libtiff Libtiff	Version 3.6.0 beta
Libtiff Libtiff	Version 3.6.1
Libtiff Libtiff	Version 3.7.0
Libtiff Libtiff	Version 3.7.0 alpha
Libtiff Libtiff	Version 3.7.0 beta2
Libtiff Libtiff	Version 3.7.0 beta
Libtiff Libtiff	Version 3.7.1
Libtiff Libtiff	Version 3.7.2
Libtiff Libtiff	Version 3.7.3
Libtiff Libtiff	Version 3.7.4
Libtiff Libtiff	Version 3.8.0
Libtiff Libtiff	Version 3.8.1
Libtiff Libtiff	Version 3.8.2
Libtiff Libtiff	Version 3.9.0
Libtiff Libtiff	Version 3.9.0 beta
Libtiff Libtiff	Version 3.9.1
Libtiff Libtiff	Version 3.9.2-5.2.1
Libtiff Libtiff	Version 3.9.2
Libtiff Libtiff	Version 3.9.3
Libtiff Libtiff	Version 3.9

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (34)

http://bugzilla.maptools.org/show_bug.cgi?id=1999

Source: secalert@redhat.com

Exploit

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058478.html

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/04/12/10

Source: secalert@redhat.com

Exploit

http://secunia.com/advisories/44271

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50726

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201209-02.xml

Source: secalert@redhat.com

http://securitytracker.com/id?1025380

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2256

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:078

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0452.html

Source: secalert@redhat.com

http://www.remotesensing.org/libtiff/v3.9.5.html

Source: secalert@redhat.com

Patch

http://www.securityfocus.com/bid/47338

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1120-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/1014

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/1082

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=695885

Source: secalert@redhat.com

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/66774

Source: secalert@redhat.com

http://bugzilla.maptools.org/show_bug.cgi?id=1999

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058478.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/04/12/10

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/44271

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/50726

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201209-02.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1025380

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2256

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2011:078

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0452.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.remotesensing.org/libtiff/v3.9.5.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/47338

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1120-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/1014

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/1082

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=695885

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/66774

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.