Category Archives: security

libtiff: assertion failure in readSeparateTilesIntoBuffer (tiffcp.c)

Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed an assertion failure. The complete output: # tiffcp -i $FILE /tmp/foo tiffcp: … Continue reading

Posted in advisories, security | Leave a comment

libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c)

Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a stack buffer overflow. The complete ASan output: # tiffsplit $FILE TIFFReadDirectory: … Continue reading

Posted in advisories, security | 1 Comment

libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c)

Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a memcpy-param-overlap. The complete ASan output: # tiff2pdf $FILE -o foo TIFFReadDirectoryCheckOrder: … Continue reading

Posted in advisories, security | Leave a comment

libtiff: multiple heap-based buffer overflow

Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. Some crafted images, through a fuzzing revealed multiple overflow. Since the number of the issues, I will … Continue reading

Posted in advisories, security | 1 Comment

libtiff: multiple divide-by-zero

Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. Some crafted images, through a fuzzing revealed multiple division by zero. Since the number of the issues, … Continue reading

Posted in advisories, security | Leave a comment

graphicsmagick: memory allocation failure in MagickRealloc (memory.c)

Description: Graphicsmagick is an Image Processing System. This is an old memory failure, discovered time ago. The maintainer, Mr. Bob Friesenhahn was able to reproduce the issue; I’m quoting his feedback about: The problem is that the embedded JPEG data … Continue reading

Posted in advisories, security | 1 Comment

libming: listswf: NULL pointer dereference in dumpBuffer (read.c)

Description: libming is a Flash (SWF) output library. It can be used from PHP, Perl, Ruby, Python, C, C++, Java, and probably more on the way.. A fuzzing revealed a null pointer access in listswf. The bug does not reside … Continue reading

Posted in advisories, security | Leave a comment

libming: listswf: heap-based buffer overflow in _iprintf (outputtxt.c)

Description: libming is a Flash (SWF) output library. It can be used from PHP, Perl, Ruby, Python, C, C++, Java, and probably more on the way.. A fuzzing revealed an overflow in listswf. The bug does not reside in any … Continue reading

Posted in advisories, security | Leave a comment

libming: listswf: heap-based buffer overflow in parseSWF_RGBA (parser.c)

Description: libming is a Flash (SWF) output library. It can be used from PHP, Perl, Ruby, Python, C, C++, Java, and probably more on the way.. A fuzzing revealed an overflow in listswf. The bug does not reside in any … Continue reading

Posted in advisories, security | Leave a comment

libming: listswf: heap-based buffer overflow in parseSWF_DEFINEFONT (parser.c)

Description: libming is a Flash (SWF) output library. It can be used from PHP, Perl, Ruby, Python, C, C++, Java, and probably more on the way.. A fuzzing revealed an overflow in listswf. The bug does not reside in any … Continue reading

Posted in advisories, security | Leave a comment