Resource exhaustion in LibTIFF - CVE-2018-10801
Published: June 14, 2018 / Updated: June 15, 2018
Vulnerability identifier: #VU13364
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10801
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to insufficient validation of user-supplied input processed by the TIFFClientOpen function, as defined in the tif_unix.c source code file. A remote attacker can use the .bmp2tiff command to execute a file that submits malicious input to the system, trigger memory leaks and cause the affected software to crash, resulting in a DoS condition.
Affected software
LibTIFF
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Fedora
libtiff
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Fedora
libtiff
How to mitigate CVE-2018-10801
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
libtiff - addressed in versions 4.0.9-12.fc28, 4.0.9-12.fc29, 4.0.9-13.fc28, 4.0.9-13.fc29