Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
2006-06-08T19:06:00.000
2025-04-03T01:03:51.193
Deferred
CVSSv2: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | libtiff | libtiff | ≤ 3.8.2 | Yes |
| Application | libtiff | libtiff | 3.4 | Yes |
| Application | libtiff | libtiff | 3.5.1 | Yes |
| Application | libtiff | libtiff | 3.5.2 | Yes |
| Application | libtiff | libtiff | 3.5.3 | Yes |
| Application | libtiff | libtiff | 3.5.4 | Yes |
| Application | libtiff | libtiff | 3.5.5 | Yes |
| Application | libtiff | libtiff | 3.5.6 | Yes |
| Application | libtiff | libtiff | 3.5.7 | Yes |
| Application | libtiff | libtiff | 3.6.0 | Yes |
| Application | libtiff | libtiff | 3.6.1 | Yes |
| Application | libtiff | libtiff | 3.7.0 | Yes |
| Application | libtiff | libtiff | 3.7.1 | Yes |
| Application | libtiff | libtiff | 3.8.0 | Yes |
| Application | libtiff | libtiff | 3.8.1 | Yes |