CVE-2006-3463

The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large td_nstrips value, which triggers an infinite loop.

🔗 References (78)

• secalert@redhatftp://patches.sgi.com/support/free/security/advisories/20060801-01-P
• secalert@redhatftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
• secalert@redhathttp://lwn.net/Alerts/194228/
• secalert@redhathttp://secunia.com/advisories/21274
• secalert@redhathttp://secunia.com/advisories/21290
• secalert@redhathttp://secunia.com/advisories/21304
• secalert@redhathttp://secunia.com/advisories/21319
• secalert@redhathttp://secunia.com/advisories/21334
• secalert@redhathttp://secunia.com/advisories/21338
• secalert@redhathttp://secunia.com/advisories/21346
• secalert@redhathttp://secunia.com/advisories/21370
• secalert@redhathttp://secunia.com/advisories/21392
• secalert@redhathttp://secunia.com/advisories/21501
• secalert@redhathttp://secunia.com/advisories/21537
• secalert@redhathttp://secunia.com/advisories/21598