Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libtiff | Libtiff | 3.4 (including) | 3.4 (including) |
| Libtiff | Libtiff | 3.5.1 (including) | 3.5.1 (including) |
| Libtiff | Libtiff | 3.5.2 (including) | 3.5.2 (including) |
| Libtiff | Libtiff | 3.5.3 (including) | 3.5.3 (including) |
| Libtiff | Libtiff | 3.5.4 (including) | 3.5.4 (including) |
| Libtiff | Libtiff | 3.5.5 (including) | 3.5.5 (including) |
| Libtiff | Libtiff | 3.5.7 (including) | 3.5.7 (including) |
| Libtiff | Libtiff | 3.6.0 (including) | 3.6.0 (including) |
| Libtiff | Libtiff | 3.6.1 (including) | 3.6.1 (including) |
| Libtiff | Libtiff | 3.7.0 (including) | 3.7.0 (including) |