NULL pointer dereference in LibTIFF - CVE-2018-7456

Vulnerability identifier: #VU10792

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7456

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The vulnerability exists in the TIFFPrintDirectory function that is defined in the tif_print.c source code file due to NULL pointer dereference. A remote attacker can create a specially crafted TIFF file, trick the victim into opening it and cause the service to crash.

LibTIFF
Arch Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Slackware Linux
Opensuse
Fedora
tiff (Alpine package)
openSUSE Leap
libtiff
Dynamic System Analysis (DSA) Preboot
Data Computing Appliance (DCA)

Install update from vendor's website.

tiff (Alpine package) - update to 4.0.9-r3
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff - addressed in versions 4.0.9-8.fc27, 4.0.9-8.fc28
Data Computing Appliance (DCA) - update to 4.3.0.0

• https://github.com/xiaoqx/pocs/tree/master/libtiff

• Denial of service in LibTIFF
• OpenSUSE Linux update for tiff
• OpenSUSE Linux update for tiff
• Slackware Linux update for libtiff
• Arch Linux update for lib32-libtiff
• Debian update for tiff
• Red Hat update for libtiff
• Red Hat update for compat-libtiff3
• Amazon Linux AMI update for libtiff
• NULL pointer dereference in tiff (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Fedora 28 update for libtiff
• Fedora 27 update for libtiff