Re: CVE-2017-7592: libtiff: left shift

[Agostino Sarubbo <ago () gentoo org>]

On Monday 10 April 2017 08:29:31 Simon McVittie wrote:
> This is a bug, but how is it a security vulnerability? Can an attacker
> exploit it for DoS or code execution or something with a malformed TIFF
> image?

Hello Simon,

the supposition is that a library stays there to receive multiple inputs, while there is 
an undefined behavior you don't know what will happen, so basically it is a 
pontential Denial of Service.

-- 
Agostino Sarubbo
Gentoo Linux Developer