Published: 17/07/2017 Updated: 22/03/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libtiff libtiff 4.0.8

LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file ...

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code For the oldstable distribution (jessie), these problems have been fixed in version 403-123+deb8u5 For the stable distribution (stretch), these problems have been fixed in version ...

Debian Bug report logs - #868513 tiff: CVE-2017-11335: tiff2pdf: heap based buffer write overflow Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 16 Jul 2017 09:45:02 UTC Severity: important Tags: fixed-upstream, ...

Debian Bug report logs - #868578 exiv2: CVE-2017-11336 CVE-2017-11337 CVE-2017-11338 CVE-2017-11339 CVE-2017-11340 Package: exiv2; Maintainer for exiv2 is Debian KDE Extras Team <pkg-kde-extras@listsaliothdebianorg>; Source for exiv2 is src:exiv2 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> ...

Debian Bug report logs - #866109 tiff: CVE-2017-9935: Heap-based buffer overflow in t2p_write_pdf Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 27 Jun 2017 12:21:01 UTC Severity: grave Tags: fixed-upstream, sec ...

A heap-based buffer overflow flaw was found within libtiff's tiff2pdf tool A remote attacker could potentially exploit this flaw to execute arbitrary code by tricking a user into converting a specially crafted file using the tiff2pdf tool ...

CWE-787 http://bugzilla.maptools.org/show_bug.cgi?id=2715 https://www.debian.org/security/2018/dsa-4100 https://usn.ubuntu.com/3602-1/https://nvd.nist.gov https://usn.ubuntu.com/3602-1/

CVE-2017-11335

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect