Heap-based buffer overflow in LibTIFF - CVE-2018-15209

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16203

Heap-based buffer overflow in LibTIFF - CVE-2018-15209

Published: December 3, 2018 / Updated: March 3, 2025


Vulnerability identifier: #VU16203
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-15209
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c. A remote unauthenticated attacker can trick the victim into opening a specially crafted crafted TIFF file, trigger memory corruption and cause the affected software to crash, resulting in a DoS condition.


Affected software

LibTIFF
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Opensuse
IBM Cloud Pak for Security
IBM Process Mining
IBM Cloud Pak for Business Automation
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
QRadar Suite
libtiff (Red Hat package)
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
Business Automation Insights

How to mitigate CVE-2018-15209

Install update from vendor's website.

Migration Toolkit for Containers - update to 1.8.4
QRadar Suite - update to 1.10.26.0
IBM Process Mining - update to 1.15.0 IF003
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
libtiff (Red Hat package) - update to 4.0.9-32.el8_10
IBM Cloud Pak for Watson AIOps - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.13.48, 4.15.28
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.19
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
Business Automation Insights - update to 24.0.0.0.1

External References

Related Security Bulletins