CVE-2013-4231
tiff - several
EPSS 18.4%
Description
Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.
How to fix CVE-2013-4231
To remediate CVE-2013-4231, upgrade the affected package to a fixed version below.
- Debian/tiff—upgrade to 4.0.3-2 or later
- Debian/tiff—upgrade to 3.9.4-5+squeeze10 or later
Is CVE-2013-4231 being exploited?
Moderate — EPSS is 18.4%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 4.0.3-2
- from 0, < 3.9.4-5+squeeze10