CVE-2018-12900: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2018-12900 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 25.18% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 26-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
25.18%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 25.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.maptools.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- libtiff< 0:4.0.9-15.el8
- libtiff-debuginfo< 0:4.0.9-15.el8
- libtiff-debugsource< 0:4.0.9-15.el8
- libtiff-devel< 0:4.0.9-15.el8
- libtiff-tools< 0:4.0.9-15.el8
Alpine1 product
- tiff< 4.0.10-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- tiff< 4.0.10-4
Libtiff1 product
- libtiff4.0.9
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.11 | < 4.0.6-1ubuntu0.6 | < 4.0.9-5ubuntu0.2
6 vendors · 11 products
