Published: 19/01/2018 Updated: 22/04/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libtiff libtiff 4.0.9
debian debian linux 8.0
debian debian linux 9.0
debian debian linux 7.0
canonical ubuntu linux 14.04
canonical ubuntu linux 17.10
canonical ubuntu linux 16.04

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed For the stable distribution (stretch), these problems have been fixed in version 408-2+deb9u4 We recommend that you upgrade your tiff package ...

LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file ...

Debian Bug report logs - #890441 tiff: CVE-2018-5784: Uncontrolled resource consumption in TIFFSetDirectory Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 14 Feb 2018 19:51:01 UTC Severity: important Tags: patch ...

Debian Bug report logs - #909037 tiff: CVE-2018-17101: Out-of-bounds Write in the tiff2bw and pal2rgb tools Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 17 Sep 2018 18:51:07 UTC Severity: grave Tags: patch, se ...

Debian Bug report logs - #909038 tiff: CVE-2018-17100: potential int32 overflow in multiply_ms() function Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 17 Sep 2018 18:57:01 UTC Severity: grave Tags: patch, secu ...

Debian Bug report logs - #911635 tiff: CVE-2018-18557: JBIG: fix potential out-of-bounds write in JBIGDecode() Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 22 Oct 2018 20:27:01 UTC Severity: grave Tags: patch, ...

Debian Bug report logs - #869823 tiff: CVE-2017-11613 Package: src:tiff; Maintainer for src:tiff is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 26 Jul 2017 19:39:01 UTC Severity: grave Tags: fixed-upstream, security, upstream Found in versions tiff/40 ...

In LibTIFF 409, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dirc Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file This occurs because the declared number of directory entries is not validated against the actual number of directory entries ...

In LibTIFF before 4010, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dirc Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file This occurs because the declared number of directory entries is not validated against the actual number of directory entries ...

CWE-400 http://bugzilla.maptools.org/show_bug.cgi?id=2772 https://usn.ubuntu.com/3602-1/https://usn.ubuntu.com/3606-1/https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html https://www.debian.org/security/2018/dsa-4349 https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef https://nvd.nist.gov https://www.debian.org/security/./dsa-4349 https://usn.ubuntu.com/3602-1/

Get Started

CVE-2018-5784

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect