CVE-2010-2596

Published: Jul 2, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."

Affected (2)

Products: Libtiff: Libtiff

Libtiff

1 product

Libtiff

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Version 3.9.0
Libtiff Libtiff	Version 3.9.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://bugzilla.maptools.org/show_bug.cgi?id=2209

Source: cve@mitre.org

http://marc.info/?l=oss-security&m=127731610612908&w=2

Source: cve@mitre.org

http://secunia.com/advisories/40422

Source: cve@mitre.org

http://secunia.com/advisories/50726

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-201209-02.xml

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=583081

Source: cve@mitre.org

Exploit

http://bugzilla.maptools.org/show_bug.cgi?id=2209