CVE-2006-2024 Denial of service in n/a
Attackers can cause denial of service in applications using libtiff by providing specially crafted TIFF images that trigger errors in various decoding functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2006-2024?
CVE-2006-2024 is a medium-severity denial of service vulnerability in Libtiff Libtiff, published on 25 Apr 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.
Which versions are affected by CVE-2006-2024?
It affects 1 product.
Products include Libtiff Libtiff.
How do I fix CVE-2006-2024?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2006-2024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-2024 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Libtiff Libtiff
Sources
Also known as DEBIAN-CVE-2006-2024, GHSA-gcqf-gvjg-mhm8.