Heap-based buffer overflow in LibTIFF - CVE-2018-12900

Vulnerability identifier: #VU16180

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12900

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c. A remote unauthenticated attacker can trick the victim into opening a specially crafted TIFF file that can trigger memory corruption and cause the service to crash.

LibTIFF
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Opensuse
tiff (Debian package)
tiff (Alpine package)
Dynamic System Analysis (DSA) Preboot
Data Computing Appliance (DCA)

Install update from vendor's website.

tiff (Debian package) - update to 4.0.8-2+deb9u5
tiff (Alpine package) - update to 4.0.10-r0
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Data Computing Appliance (DCA) - update to 4.3.0.0

• http://bugzilla.maptools.org/show_bug.cgi?id=2798

• OpenSUSE Linux update for tiff
• OpenSUSE Linux update for tiff
• Red Hat update for libtiff
• Amazon Linux AMI update for libtiff
• Red Hat update for libtiff
• Debian update for tiff
• Heap-based buffer overflow in tiff (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot