CVE-2005-2452

libtiff <= 3.7.0 - Denial of Service via Zero YCbCr Subsampling Value

Title source: llm
STIX 2.1

Description

libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c, a different vulnerability than CVE-2004-0804.

References (8)

Core 8
Core References
Issue Tracking x_refsource_misc
https://bugzilla.ubuntu.com/show_bug.cgi?id=12008
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:143
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16486
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:144
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/156-1/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16266
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/14417
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:142

Scores

EPSS 0.0134
EPSS Percentile 80.3%

Details

Status published
Products (3)
libtiff/libtiff 3.5.5
libtiff/libtiff 3.5.7
libtiff/libtiff 3.6.1
Published Aug 03, 2005
Tracked Since Feb 18, 2026