NULL pointer dereference in LibTIFF - CVE-2018-17000

Vulnerability identifier: #VU18498

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17000

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction). A remote attacker can create a specially crafted tiff file and perform a denial of service (DoS) attack.

LibTIFF
Ubuntu
Opensuse
libtiff5 (Ubuntu package)
libtiff-tools (Ubuntu package)
tiff (Debian package)

Install update from vendor's website.

LibTIFF - update to 4.0.10
libtiff5 (Ubuntu package) - addressed in versions 4.0.3-7ubuntu0.11, 4.0.6-1ubuntu0.6, 4.0.9-5ubuntu0.2, 4.0.9-6ubuntu0.2
libtiff-tools (Ubuntu package) - addressed in versions 4.0.3-7ubuntu0.11, 4.0.6-1ubuntu0.6, 4.0.9-5ubuntu0.2, 4.0.9-6ubuntu0.2
tiff (Debian package) - update to 4.0.8-2+deb9u5

• http://bugzilla.maptools.org/show_bug.cgi?id=2811
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html
• http://www.securityfocus.com/bid/105342
• https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html
• https://usn.ubuntu.com/3906-1/

• OpenSUSE Linux update for tiff
• Debian update for tiff
• Ubuntu update for tiff