Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libtiff | Libtiff | * | 3.8.0 (including) |
| Libtiff | Libtiff | 3.4 (including) | 3.4 (including) |
| Libtiff | Libtiff | 3.5.1 (including) | 3.5.1 (including) |
| Libtiff | Libtiff | 3.5.2 (including) | 3.5.2 (including) |
| Libtiff | Libtiff | 3.5.3 (including) | 3.5.3 (including) |
| Libtiff | Libtiff | 3.5.4 (including) | 3.5.4 (including) |
| Libtiff | Libtiff | 3.5.5 (including) | 3.5.5 (including) |
| Libtiff | Libtiff | 3.5.6 (including) | 3.5.6 (including) |
| Libtiff | Libtiff | 3.5.7 (including) | 3.5.7 (including) |
| Libtiff | Libtiff | 3.6.0 (including) | 3.6.0 (including) |
| Libtiff | Libtiff | 3.6.1 (including) | 3.6.1 (including) |
| Libtiff | Libtiff | 3.7.0 (including) | 3.7.0 (including) |
| Libtiff | Libtiff | 3.7.1 (including) | 3.7.1 (including) |