BSD Ports(lib)tiff -- Integer Overflow or Wraparound
PrymEvol and Quang Luong reports: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
Affected versions
- tiff < 4.7.1_1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | graphics/tiff | 4.7.0 | vulnerable since 2026-04-11 | |
| OpenBSD | graphics/tiff | 4.7.2 | out of range, by version | |
| NetBSD | graphics/tiff | 4.7.2 | not listed | |
| MidnightBSD | graphics/tiff | 4.7.1 | out of range, by version | |
| FreeBSD | graphics/tiff | 4.7.2 | fixed | (100 days after) |