| Severity |
|
| Remote |
|
| Type |
|
| Description |
| + |
A buffer read overflow has been discovered in libtiff. The function TIFFFetchNormalTag() in libtiff/tif_dirread.c did not make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated leading to potential read outside the buffer in _TIFFPrintField(). |
|
| References |
| + |
http://bugzilla.maptools.org/show_bug.cgi?id=2590 |
| + |
http://bugzilla.maptools.org/show_bug.cgi?id=2593 |
| + |
https://github.com/vadz/libtiff/commit/30c9234c7fd0dd5e8b1e83ad44370c875a0270ed |
| + |
https://github.com/vadz/libtiff/commit/89406285f318ffad27af4b200204394b2ee6ba5e |
|
| Notes |
| + |
FIXED: |
| + |
2016-11-11 Even Rouault <even.rouault at spatialys.com> |
| + |
libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated, to avoid potential read outside buffer in _TIFFPrintField(). |
|