Skip to content
OpenAdvisories
Unscored USN-2553-1 6 CVEs

tiff vulnerabilities

Published Mar 31, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

William Robinet discovered that LibTIFF incorrectly handled certain
malformed images. If a user or automated system were tricked into opening a
specially crafted image, a remote attacker could crash the application,
leading to a denial of service, or possibly execute arbitrary code with
user privileges. (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129,
CVE-2014-8130)

Paris Zoumpouloglou discovered that LibTIFF incorrectly handled certain
malformed BMP images. If a user or automated system were tricked into
opening a specially crafted BMP image, a remote attacker could crash the
application, leading to a denial of service. (CVE-2014-9330)

Michal Zalewski discovered that LibTIFF incorrectly handled certain
malformed images. If a user or automated system were tricked into opening a
specially crafted image, a remote attacker could crash the application,
leading to a denial of service, or possibly execute arbitrary code with
user privileges. (CVE-2014-9655)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS tiff 4.0.3-7ubuntu0.2

Vulnerabilities 6

  • Unscored —
    CVE-2014-8127

    LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF im…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2014-8128

    LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attac…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-8129

    LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified o…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-8130

    The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to c…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-9330

    Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (cr…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-9655

    The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows …

    tiff tiff Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-8127
  • report
    https://ubuntu.com/security/CVE-2014-8128
  • report
    https://ubuntu.com/security/CVE-2014-8129
  • report
    https://ubuntu.com/security/CVE-2014-8130
  • report
    https://ubuntu.com/security/CVE-2014-9330
  • report
    https://ubuntu.com/security/CVE-2014-9655