CVE-2020-35524

Published: Mar 9, 2021Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Affected (8)

Products: Libtiff: Libtiff · Debian: Debian Linux · Fedoraproject: Fedora · +2 more

Show all products

Libtiff: Libtiff · Debian: Debian Linux · Fedoraproject: Fedora · Netapp: Ontap Select Deploy Administration Utility · Redhat: Enterprise Linux

1 product

1 product

1 product

1 product

Ontap Select Deploy Administration Utility

1 product

Enterprise Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Before 4.2.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0
Fedoraproject Fedora	Version 33

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap Select Deploy Administration Utility	All versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (16)

https://bugzilla.redhat.com/show_bug.cgi?id=1932044

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://gitlab.com/libtiff/libtiff/-/merge_requests/159

Source: secalert@redhat.com

PatchThird Party Advisory

https://gitlab.com/rzkn/libtiff/-/commit/7be2e452ddcf6d7abca88f41d3761e6edab72b22

Source: secalert@redhat.com

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00023.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMHBYFMX3D5VGR6Y3RXTTH3Q4NF4E6IG/

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202104-06

Source: secalert@redhat.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210521-0009/

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2021/dsa-4869

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1932044

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://gitlab.com/libtiff/libtiff/-/merge_requests/159

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://gitlab.com/rzkn/libtiff/-/commit/7be2e452ddcf6d7abca88f41d3761e6edab72b22

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMHBYFMX3D5VGR6Y3RXTTH3Q4NF4E6IG/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202104-06

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210521-0009/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2021/dsa-4869

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.