Executive Summary

Informations
Name CVE-2012-5581 First vendor Publication 2013-01-04
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5581

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18058
 
Oval ID: oval:org.mitre.oval:def:18058
Title: DSA-2589-1 tiff - buffer overflow
Description: The tiff library for handling TIFF image files contained a stack-based buffer overflow, potentially allowing attackers who can submit such files to a vulnerable system to execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2589-1
CVE-2012-5581
 Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): tiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18117
 
Oval ID: oval:org.mitre.oval:def:18117
Title: USN-1655-1 -- tiff vulnerability
Description: Programs that use LibTIFF could be made to crash or run programs if they opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1655-1
CVE-2012-5581
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Ubuntu 8.04
 Product(s): tiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21373
 
Oval ID: oval:org.mitre.oval:def:21373
Title: RHSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): RHSA-2012:1590-01
CESA-2012:1590
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 55
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22764
 
Oval ID: oval:org.mitre.oval:def:22764
Title: DEPRECATED: ELSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): ELSA-2012:1590-01
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 22
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23936
 
Oval ID: oval:org.mitre.oval:def:23936
Title: ELSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): ELSA-2012:1590-01
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 21
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27430
 
Oval ID: oval:org.mitre.oval:def:27430
Title: DEPRECATED: ELSA-2012-1590 -- libtiff security update (moderate)
Description: [3.9.4-9] - Still more fixes to make test case for CVE-2012-5581 work on all platforms Resolves: #885310 [3.9.4-8] - Fix incomplete patch for CVE-2012-3401 - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works with pre-4.0.2 libtiff Resolves: #885310 [3.9.4-7] - Add fixes for CVE-2012-3401, CVE-2012-4447, CVE-2012-4564, CVE-2012-5581 Resolves: #885310
Family: unix Class: patch
Reference(s): ELSA-2012-1590
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 60

OpenVAS Exploits

Date Description
2013-09-18 Name : Debian Security Advisory DSA 2589-1 (tiff - buffer overflow)
File : nvt/deb_2589_1.nasl
2012-12-31 Name : Fedora Update for libtiff FEDORA-2012-20404
File : nvt/gb_fedora_2012_20404_libtiff_fc16.nasl
2012-12-31 Name : Fedora Update for libtiff FEDORA-2012-20446
File : nvt/gb_fedora_2012_20446_libtiff_fc17.nasl
2012-12-31 Name : Mandriva Update for libtiff MDVSA-2012:184 (libtiff)
File : nvt/gb_mandriva_MDVSA_2012_184.nasl
2012-12-26 Name : CentOS Update for libtiff CESA-2012:1590 centos5
File : nvt/gb_CESA-2012_1590_libtiff_centos5.nasl
2012-12-26 Name : CentOS Update for libtiff CESA-2012:1590 centos6
File : nvt/gb_CESA-2012_1590_libtiff_centos6.nasl
2012-12-26 Name : RedHat Update for libtiff RHSA-2012:1590-01
File : nvt/gb_RHSA-2012_1590-01_libtiff.nasl
2012-12-06 Name : Ubuntu Update for tiff USN-1655-1
File : nvt/gb_ubuntu_USN_1655_1.nasl

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_libtiff_20140617.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-29.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-147.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-046.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libtiff-8419.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libtiff-devel-130109.nasl - Type : ACT_GATHER_INFO
2013-01-14 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20348.nasl - Type : ACT_GATHER_INFO
2012-12-31 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20404.nasl - Type : ACT_GATHER_INFO
2012-12-31 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20446.nasl - Type : ACT_GATHER_INFO
2012-12-28 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-184.nasl - Type : ACT_GATHER_INFO
2012-12-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2012-12-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20121218_libtiff_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-12-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2012-12-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2589.nasl - Type : ACT_GATHER_INFO
2012-12-06 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1655-1.nasl - Type : ACT_GATHER_INFO
2006-11-06 Name : The remote host is missing Sun Security Patch number 119901-17
File : solaris10_x86_119901.nasl - Type : ACT_GATHER_INFO
2006-11-06 Name : The remote host is missing Sun Security Patch number 119900-18
File : solaris10_119900.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html
http://rhn.redhat.com/errata/RHSA-2012-1590.html
http://secunia.com/advisories/51491
http://www.debian.org/security/2012/dsa-2589
http://www.openwall.com/lists/oss-security/2012/11/28/1
http://www.securityfocus.com/bid/56715
http://www.ubuntu.com/usn/USN-1655-1
https://bugzilla.redhat.com/show_bug.cgi?id=867235
https://exchange.xforce.ibmcloud.com/vulnerabilities/80339
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
Date Informations
2024-11-28 22:58:38
  • Multiple Updates
2024-11-28 12:32:25
  • Multiple Updates
2023-05-27 01:17:15
  • Multiple Updates
2023-02-13 05:28:29
  • Multiple Updates
2023-02-02 21:28:40
  • Multiple Updates
2021-05-04 12:22:36
  • Multiple Updates
2021-04-22 01:26:59
  • Multiple Updates
2020-05-23 01:50:19
  • Multiple Updates
2020-05-23 00:35:17
  • Multiple Updates
2017-11-30 09:21:30
  • Multiple Updates
2017-08-29 09:24:09
  • Multiple Updates
2016-04-26 22:29:54
  • Multiple Updates
2015-01-21 13:25:53
  • Multiple Updates
2014-06-26 13:26:03
  • Multiple Updates
2014-06-14 13:33:58
  • Multiple Updates
2014-02-17 11:14:24
  • Multiple Updates
2013-09-20 17:21:17
  • Multiple Updates
2013-05-10 22:49:47
  • Multiple Updates
2013-02-08 13:20:11
  • Multiple Updates
2013-02-07 13:21:00
  • Multiple Updates
2013-01-15 21:21:16
  • Multiple Updates
2013-01-07 21:20:42
  • Multiple Updates
2013-01-05 13:21:59
  • First insertion