CVE-2012-4447

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-28 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.

Affected products

libtiff: through 4.0.2; 3.4, 3.4-beta18, 3.4-beta24, 3.4-beta28, 3.4-beta29, 3.4-beta31 (+51)

References

http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html
http://rhn.redhat.com/errata/RHSA-2012-1590.html
http://secunia.com/advisories/49938
http://secunia.com/advisories/51049
http://www.debian.org/security/2012/dsa-2561
http://www.openwall.com/lists/oss-security/2012/09/25/14
http://www.openwall.com/lists/oss-security/2012/09/25/9
http://www.remotesensing.org/libtiff/v4.0.3.html
http://www.securityfocus.com/bid/55673
http://www.ubuntu.com/usn/USN-1631-1
https://bugzilla.redhat.com/show_bug.cgi?id=860198
http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html

Get alerted when CVE-2012-4447 or the next vulnerability affects your stack