Published: 09/02/2019 Updated: 24/08/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

An Invalid Address dereference exists in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libtiff libtiff 4.0.10
debian debian linux 8.0
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
canonical ubuntu linux 12.04
opensuse leap 15.0

Several vulnerabilities have been found in the TIFF library, which may result in denial of service or the execution of arbitrary code if malformed image files are processed For the oldstable distribution (stretch), these problems have been fixed in version 408-2+deb9u5 We recommend that you upgrade your tiff packages For the detailed security ...

LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file ...

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwritec in LibTIFF 4010, affecting the cpSeparateBufToContigBuf function in tiffcpc Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file ...

NVD-CWE-noinfo http://bugzilla.maptools.org/show_bug.cgi?id=2833 https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html https://usn.ubuntu.com/3906-1/https://usn.ubuntu.com/3906-2/http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39 https://security.gentoo.org/glsa/202003-25 https://www.debian.org/security/2020/dsa-4670 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4670 https://usn.ubuntu.com/3906-1/

CVE-2019-7663

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect