CVE-2019-17546: libtiff Integer Overflow or Wraparound
CVSS: 8.8v3.1HighModified
AliasesMGASA-2019-0366RHSA-2020:4634UBUNTU-CVE-2019-17546DEBIAN-CVE-2019-17546DLA-2147-1
Published 14-10-2019Last modified 20-12-2024
Vulnerability summary
CVE-2019-17546 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in libtiff. EPSS estimates a 3.36% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
3.36%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 14-10-2019PublishedVulnerability first disclosed.
- 20-12-2024Last modifiedVulnerability information updated.
Description
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · Red hatEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.36%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.36% on 19-09-2026
19-09-202619-10-2026
EPSS score3.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu7 products
- gdal< 1.10.1+dfsg-5ubuntu1+esm1 | All versions (No fix recorded)
- neuronAll versions (No fix recorded)
- paraviewAll versions (No fix recorded)
- qtimageformats-opensource-srcAll versions (No fix recorded)
- qtwebengine-opensource-srcAll versions (No fix recorded)
Redhat6 products
- libtiff< 0:4.0.9-18.el8
- libtiff-debuginfo< 0:4.0.9-18.el8
- libtiff-debugsource< 0:4.0.9-18.el8
- libtiff-devel< 0:4.0.9-18.el8
- libtiff-tools< 0:4.0.9-18.el8
Debian2 products
- gdal< 3.1.0+dfsg-1 | < 1.10.1+dfsg-8+deb8u2
- tiff< 4.0.10+git190818-1
Libtiff1 product
- libtiff< 4.1.0
Mageia1 product
- libtiff< 4.1.0-2.git20191120.1.mga7
Osgeo1 product
- gdal≤ 3.0.1
6 vendors · 18 products
References
27 links- github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddfX Refsource MISCPatchThird Party Advisory
- gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145X Refsource MISCPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/11/msg00027.htmlMailing ListX Refsource MLISTThird Party Advisory
