Memory leak in LibTIFF - CVE-2017-9936

Vulnerability identifier: #VU7406

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9936

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exits due to memory leak in tif_jbig.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

LibTIFF
Debian Linux
tiff (Alpine package)

Update to version 4.0.8-3.

tiff (Alpine package) - update to 4.0.8-r0

• Exploit #1260 - LibTIFF - 'tif_jbig.c' Denial of Service (March 18, 2020)

• http://bugzilla.maptools.org/show_bug.cgi?id=2706

• Debian update for tiff
• Memory leak in tiff (Alpine package)