Vulnerability Description
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtiff | Libtiff | <= 3.8.2 |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355
- http://bugzilla.remotesensing.org/show_bug.cgi?id=1196ExploitPatch
- http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html
- http://secunia.com/advisories/20488PatchVendor Advisory
- http://secunia.com/advisories/20501
- http://secunia.com/advisories/20520
- http://secunia.com/advisories/20693
- http://secunia.com/advisories/20766
- http://secunia.com/advisories/21002
- http://secunia.com/advisories/27181
- http://secunia.com/advisories/27222
- http://secunia.com/advisories/27832
- http://secunia.com/advisories/31670
- http://security.gentoo.org/glsa/glsa-200607-03.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1
FAQ
What is CVE-2006-2193?
CVE-2006-2193 is a vulnerability with a CVSS score of 7.5 (HIGH). Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file ...
How severe is CVE-2006-2193?
CVE-2006-2193 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-2193?
Check the references section above for vendor advisories and patch information. Affected products include: Libtiff Libtiff.