CVE-2012-4564
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote...
CVE-2012-4564 is a medium vulnerability (CVSS 6.8) in Canonical Ubuntu Linux, published November 11, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. Fixed in tiff 4.0.2-5.
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
CVE-2012-4564- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
CVE-2012-4564- Updated
- 2026-11-02
EUVDEUVD-2012-4492 No score
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
EUVD-2012-4492- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x7qp-frp5-95fm No score
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote...
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
GHSA-x7qp-frp5-95fm- Updated
- 2026-11-02
OSV No score
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
CVE-2012-4564- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4564 No score
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
- Record
DEBIAN-CVE-2012-4564- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10554-1 No score
libtiff-devel-32bit-4.0.7-1.1 on GA media
These are all security issues fixed in the libtiff-devel-32bit-4.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10554-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tiffDebian:12 |
before 4.0.2-5 | 4.0.2-5 |
tiffDebian:13 |
before 4.0.2-5 | 4.0.2-5 |
tiffDebian:14 |
before 4.0.2-5 | 4.0.2-5 |
tiffDebian:6.0 |
before 3.9.4-5+squeeze7, plus listed versions 3.9.4-53.9.4-5+squeeze13.9.4-5+squeeze23.9.4-5+squeeze33.9.4-5+squeeze43.9.4-5+squeeze53.9.4-5+squeeze6 |
3.9.4-5+squeeze7 |
libtiffRed Hat:enterprise_linux:5::client |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiff-debuginfoRed Hat:enterprise_linux:5::client |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiffRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiff-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiff-develRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiffRed Hat:enterprise_linux:5::server |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtiff-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiff-develRed Hat:enterprise_linux:5::server |
before 0:3.8.2-18.el5_8 | 0:3.8.2-18.el5_8 |
libtiffRed Hat:enterprise_linux:6::client |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::client |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::client |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiffRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiffRed Hat:enterprise_linux:6::server |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::server |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::server |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiffRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-9.el6_3 | 0:3.9.4-9.el6_3 |
tiffopenSUSE:Tumbleweed |
before 4.0.7-1.1 | 4.0.7-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2012/dsa-2575
osvdb.org/86878
bugzilla.redhat.com/show_bug.cgi?id=871700
openwall.com/lists/oss-security/2012/11/02/3
securityfocus.com/bid/56372
ubuntu.com/usn/USN-1631-1
Show 74 moreShow less
lists.opensuse.org/opensuse-updates/2013-01/msg00076.html
exchange.xforce.ibmcloud.com/vulnerabilities/79750
secunia.com/advisories/51133
rhn.redhat.com/errata/RHSA-2012-1590.html
nvd.nist.gov/vuln/detail/CVE-2012-4564
access.redhat.com/errata/RHSA-2012:1590
github.com/advisories/GHSA-x7qp-frp5-95fm
security-tracker.debian.org/tracker/CVE-2012-4564
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1590.json
cve.org/CVERecord?id=CVE-2012-3401
suse.com/security/cve/CVE-2009-2285