Improper input validation in LibTIFF - CVE-2017-11613

Vulnerability identifier: #VU11494

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11613

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the TIFFOpen function due to improper checking of td_imagelength during the TIFFOpen process. A remote attacker can cause the service to crash.

LibTIFF
Arch Linux
Debian Linux
Ubuntu
Opensuse
Fedora
tiff (Alpine package)
openSUSE Leap
libtiff5 (Ubuntu package)
libtiff-tools (Ubuntu package)
libtiff
Dynamic System Analysis (DSA) Preboot

Install update from vendor's website.

tiff (Alpine package) - addressed in versions 4.0.9-r5, 4.0.9-r6
libtiff5 (Ubuntu package) - addressed in versions 4.0.3-7ubuntu0.9, 4.0.6-1ubuntu0.4, 4.0.8-5ubuntu0.1
libtiff-tools (Ubuntu package) - addressed in versions 4.0.3-7ubuntu0.9, 4.0.6-1ubuntu0.4, 4.0.8-5ubuntu0.1
libtiff - addressed in versions 4.0.9-10.fc27, 4.0.9-10.fc28
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65

• https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f

• Multiple vulnerabilities in LibTIFF
• OpenSUSE Linux update for tiff
• OpenSUSE Linux update for tiff
• Arch Linux update for libtiff
• Arch Linux update for lib32-libtiff
• Debian update for tiff
• OpenSUSE Linux update for tiff
• Improper input validation in tiff (Alpine package)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Fedora 27 update for libtiff
• Fedora 28 update for libtiff
• Ubuntu update for tiff