Heap-based buffer overflow in LibTIFF - CVE-2018-8905

Vulnerability identifier: #VU11263

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8905

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in the LZWDecodeCompat function due to insufficient validation of user-supplied input. A remote attacker can submit a specially crafted TIFF file, cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

LibTIFF
Arch Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Slackware Linux
Opensuse
Fedora
tiff (Alpine package)
openSUSE Leap
libtiff
Dynamic System Analysis (DSA) Preboot
Data Computing Appliance (DCA)

Install update from vendor's website.

LibTIFF - update to 4.0.10
tiff (Alpine package) - update to 4.0.9-r4
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff - addressed in versions 4.0.9-9.fc27, 4.0.9-9.fc28
Data Computing Appliance (DCA) - update to 4.3.0.0

• https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow

• Remote code execution in LibTIFF
• OpenSUSE Linux update for tiff
• OpenSUSE Linux update for tiff
• Slackware Linux update for libtiff
• Arch Linux update for lib32-libtiff
• Debian update for tiff
• Red Hat update for libtiff
• Amazon Linux AMI update for libtiff
• Heap-based buffer overflow in tiff (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Fedora 27 update for libtiff
• Fedora 28 update for libtiff