CVE-2018-7456: canonical ubuntu_linux NULL Pointer Dereference
Vulnerability summary
CVE-2018-7456 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 2.99% chance of exploitation in the next 30 days, higher than 87.1% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 24-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated3.3LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.99%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.99% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundPocs
Maturity: poc
Exploit Reference (bugzilla.maptools.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian3 products
- tiff< 4.0.9-5 | < 4.0.2-6+deb7u19
- tiff3< 3.9.6-11+deb7u10
- debian_linuxEOL7.0 | 8.0 | 9.0
Mageia2 products
- libtiff< 4.0.9-1.3.mga5
- libtiff< 4.0.9-1.3.mga6
Redhat2 products
- compat-libtiff3< 0:3.9.4-12.el7
- compat-libtiff3-debuginfo< 0:3.9.4-12.el7
Alpine1 product
- tiff< 4.0.9-r4 | < 4.0.9-r3
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Libtiff1 product
- libtiff4.0.9
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.10 | < 4.0.6-1ubuntu0.5
7 vendors · 11 products
References
23 links
lists.debian.org/debian-lts-announce/2018/04/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2018/07/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/04/msg00010.htmlMailing ListX Refsource MLISTThird Party Advisory
- gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731bX Refsource CONFIRMPatchThird Party Advisory
