There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack. Upstream bug: http://bugzilla.maptools.org/show_bug.cgi?id=2715 Upstream patch: https://github.com/vadz/libtiff/commit/69bfeec247899776b1b396651adb47436e5f1556
Created libtiff tracking bugs for this issue: Affects: fedora-all [bug 1474373] Created mingw-libtiff tracking bugs for this issue: Affects: epel-7 [bug 1474372] Affects: fedora-all [bug 1474374]
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.