Risk | High |
Patch available | YES |
Number of vulnerabilities | 6 |
CVE-ID | CVE-2016-10095 CVE-2017-9147 CVE-2017-9403 CVE-2017-9404 CVE-2017-9936 CVE-2017-10688 |
CWE-ID | CWE-121 CWE-20 CWE-401 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #5 is available. Public exploit code for vulnerability #6 is available. |
Vulnerable software Subscribe |
Debian Linux Operating systems & Components / Operating system |
Vendor | Debian |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
EUVDB-ID: #VU7402
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-10095
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7403
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-9147
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to invalid read in the _TIFFVGetField function in tif_dir.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU7404
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9403
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to memory leak in the function TIFFReadDirEntryLong8Array in tif_dirread.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7405
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9404
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to memory leak in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU7406
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-9936
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to memory leak in tif_jbig.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU7407
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-10688
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to cause DoS condition.
The weakness exits due to assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.0.3-12.3+deb8u4, 4.0.8-2+deb9u1, 4.0.8-3, 4.0.8-3
Vulnerable software versionsDebian Linux: All versions
External linkshttp://www.debian.org/security/2017/dsa-3903
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.