CVE-2006-2193

libtiff < 3.8.2 - Buffer Overflow in t2p_write_pdf_string via UTF-8 DocumentName Tag

Title source: llm

Description

Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.

References (26)

Core 26

Core References

Exploit, Patch x_refsource_confirm

http://bugzilla.remotesensing.org/show_bug.cgi?id=1196

Issue Tracking x_refsource_confirm

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/3486

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/31670

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:102

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/2197

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20520

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20766

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20488

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200607-03.xml

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20501

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27222

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/4034

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9788

Patch, Vendor Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1091

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0848.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27181

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20693

Various Sources vendor-advisory x_refsource_suse

http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27832

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/26991

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21002

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/18331

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/289-1/

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1

Scores

EPSS 0.0064

EPSS Percentile 70.8%

Details

Status published

Products (15)

libtiff/libtiff 3.4

libtiff/libtiff 3.5.1

libtiff/libtiff 3.5.2

libtiff/libtiff 3.5.3

libtiff/libtiff 3.5.4

libtiff/libtiff 3.5.5

libtiff/libtiff 3.5.6

libtiff/libtiff 3.5.7

libtiff/libtiff 3.6.0

libtiff/libtiff 3.6.1

... and 5 more

Published Jun 08, 2006

Tracked Since Feb 18, 2026