CVE-2012-2113
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a...
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
CVE-2012-2113- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
CVE-2012-2113- Updated
- 2026-11-02
EUVDEUVD-2012-2115 No score
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
EUVD-2012-2115- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2mff-8r7p-g487 No score
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a...
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
GHSA-2mff-8r7p-g487- Updated
- 2026-11-02
OSV No score
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
CVE-2012-2113- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2113 No score
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2012-2113- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10554-1 No score
libtiff-devel-32bit-4.0.7-1.1 on GA media
These are all security issues fixed in the libtiff-devel-32bit-4.0.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10554-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tiffDebian:12 |
before 4.0.2-1 | 4.0.2-1 |
tiffDebian:13 |
before 4.0.2-1 | 4.0.2-1 |
tiffDebian:14 |
before 4.0.2-1 | 4.0.2-1 |
tiffDebian:6.0 |
before 3.9.4-5+squeeze5, plus listed versions 3.9.4-53.9.4-5+squeeze13.9.4-5+squeeze23.9.4-5+squeeze33.9.4-5+squeeze4 |
3.9.4-5+squeeze5 |
libtiffRed Hat:enterprise_linux:5::client |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiff-debuginfoRed Hat:enterprise_linux:5::client |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiffRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiff-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiff-develRed Hat:enterprise_linux:5::client_workstation |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiffRed Hat:enterprise_linux:5::server |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtiff-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiff-develRed Hat:enterprise_linux:5::server |
before 0:3.8.2-15.el5_8 | 0:3.8.2-15.el5_8 |
libtiffRed Hat:enterprise_linux:6::client |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::client |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::client |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiffRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiffRed Hat:enterprise_linux:6::server |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::server |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::server |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiffRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-develRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
libtiff-staticRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-6.el6_3 | 0:3.9.4-6.el6_3 |
tiffopenSUSE:Tumbleweed |
before 4.0.7-1.1 | 4.0.7-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2113 is a medium vulnerability (CVSS 6.8) in Libtiff, published July 22, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.55%, the 92nd percentile. Fixed in tiff 4.0.2-1.
References
securityfocus.com/bid/54076
secunia.com/advisories/49493
remotesensing.org/libtiff/v4.0.2.html
hermes.opensuse.org/messages/15083566
lists.opensuse.org/opensuse-security-announce/2012-07/msg00010.html
debian.org/security/2012/dsa-2552
Show 67 moreShow less
rhn.redhat.com/errata/RHSA-2012-1054.html
security.gentoo.org/glsa/glsa-201209-02.xml
bugzilla.redhat.com/show_bug.cgi?id=810551
mandriva.com/security/advisories?name=MDVSA-2012:101
nvd.nist.gov/vuln/detail/CVE-2012-2113
access.redhat.com/errata/RHSA-2012:1054
github.com/advisories/GHSA-2mff-8r7p-g487
security-tracker.debian.org/tracker/CVE-2012-2113
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1054.json
cve.org/CVERecord?id=CVE-2012-2088
suse.com/security/cve/CVE-2009-2285