CVE-2010-2596
Fixed in a distro release EPSS 2%
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
Products: libtiff
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | lib32-libtiff | 4.0.7-1 |
| Arch Linux | libtiff | 4.0.7-1 |
| Debian 12 | tiff | 4.0.6-1 |
| Debian 13 | tiff | 4.0.6-1 |
| Debian 14 | tiff | 4.0.6-1 |
| Debian 7 | tiff3 | 3.9.6-11+deb7u1 |
| Red Hat Enterprise Linux 6 | libtiff | 0:3.9.4-10.el6_5 |
| Red Hat Enterprise Linux 6 | libtiff-debuginfo | 0:3.9.4-10.el6_5 |
| Red Hat Enterprise Linux 6 | libtiff-devel | 0:3.9.4-10.el6_5 |
| Red Hat Enterprise Linux 6 | libtiff-static | 0:3.9.4-10.el6_5 |