CVE-2012-4564
tiff - heap overflow
EPSS 27.2%
Description
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
How to fix CVE-2012-4564
To remediate CVE-2012-4564, upgrade the affected package to a fixed version below.
- Debian/tiff—upgrade to 4.0.2-5 or later
- Debian/tiff—upgrade to 3.9.4-5+squeeze7 or later
Is CVE-2012-4564 being exploited?
Moderate — EPSS is 27.2%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 4.0.2-5
- from 0, < 3.9.4-5+squeeze7