MGASA-2017-0210: libtiff Mageia
CVSS: UnknownPublished
Published 22-07-2017Last modified 16-04-2026
Vulnerability summary
MGASA-2017-0210 is a vulnerability in libtiff Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0Timeline
- 22-07-2017PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated libtiff packages fix security vulnerabilities Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code (CVE-2017-9936, CVE-2017-10688).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia1 product
- libtiff< 4.0.8-1.1.mga5
1 vendor · 1 product
References
3 links
Related vulnerabilities
MGASA-2018-0246mageialibtiff+1Updated libtiff packages fix security vulnerabilities
The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF
through 4.0.9 allows remote attackers to cause a denial of service
(assertion failure and application crash) via a crafted file, a
different vulnerability than CVE-2017-13726. (CVE-2018-10963)
In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function
LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated
by tiff2ps. (CVE-2018-8905)MGASA-2018-0180mageialibtiff+1Updated libtiff packages fix security vulnerabilities
In LibTIFF 4.0.8, there is a denial of service vulnerability in the
TIFFOpen function. A crafted input will lead to a denial of service
attack. During the TIFFOpen process, td_imagelength is not checked. The
value of td_imagelength can be directly controlled by an input file. In
the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc
function is called based on td_imagelength. If we set the value of
td_imagelength close to the amount of system memory, it will hang the
system or trigger the OOM killer. (CVE-2017-11613)
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the
TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage
this vulnerability to cause a denial of service via a crafted tif file.
This occurs because the declared number of directory entries is not
validated against the actual number of directory entries. (CVE-2018-5784)MGASA-2018-0109mageialibtiff+1Updated libtiff packages fix security vulnerability
tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to
cause a denial of service (TIFFSetupStrips heap-based buffer overflow and
application crash) or possibly have unspecified other impact via a crafted
TIFF file. (CVE-2017-17095)
In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf
function in tools/tiff2pdf.c. This heap overflow could lead to different
damages. For example, a crafted TIFF document can lead to an out-of-bounds
read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory
corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given
these possibilities, it probably could cause arbitrary code execution.
(CVE-2017-9935)
In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c
TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
(CVE-2017-18013)MGASA-2017-0431mageialibtiff+1Updated libtiff packages fix security vulnerabilities & bugs
The updated packages fix many bugs. Some of those bugs can be related
to security problems as well.MGASA-2017-0199mageialibtiffUpdated libtiff packages fix security vulnerability
Heap-based buffer overflow in the readContigStripsIntoBuffer function in
tif_unix.c in LibTIFF 4.0.7 allows remote attackers to have unspecified
impact via a crafted image. (CVE-2016-10092)
Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7 allows remote
attackers to have unspecified impact via a crafted image, which triggers a
heap-based buffer overflow. (CVE-2016-10093)
Off-by-one error in the t2p_readwrite_pdf_image_tile function in
tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have
unspecified impact via a crafted image. (CVE-2016-10094)
Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (crash)
via a crafted TIFF file. (CVE-2016-10095)
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the
tools/tiffcp resulting in DoS or code execution via a crafted
BitsPerSample value. (CVE-2017-5225)
LibTIFF 4.0.7 allows remote attackers to cause a denial of service
(divide-by-zero error and application crash) via a crafted TIFF image,
related to libtiff/tif_read.c:351:22. (CVE-2016-10266)
LibTIFF 4.0.7 allows remote attackers to cause a denial of service
(divide-by-zero error and application crash) via a crafted TIFF image,
related to libtiff/tif_ojpeg.c:816:8. (CVE-2016-10267)
tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial
of service (integer underflow and heap-based buffer under-read) or
possibly have unspecified other impact via a crafted TIFF image, related
to "READ of size 78490" and libtiff/tif_unix.c:115:23. (CVE-2016-10268)
LibTIFF 4.0.7 allows remote attackers to cause a denial of service
(heap-based buffer over-read) or possibly have unspecified other impact
via a crafted TIFF image, related to "READ of size 512" and
libtiff/tif_unix.c:340:2. (CVE-2016-10269)
LibTIFF 4.0.7 allows remote attackers to cause a denial of service
(heap-based buffer over-read) or possibly have unspecified other impact
via a crafted TIFF image, related to "READ of size 8" and
libtiff/tif_read.c:523:22. (CVE-2016-10270)
tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a
denial of service (heap-based buffer over-read and buffer overflow) or
possibly have unspecified other impact via a crafted TIFF image, related
to "READ of size 1" and libtiff/tif_fax3.c:413:13. (CVE-2016-10271)
LibTIFF 4.0.7 allows remote attackers to cause a denial of service
(heap-based buffer overflow) or possibly have unspecified other impact via
a crafted TIFF image, related to "WRITE of size 2048" and
libtiff/tif_next.c:64:9. (CVE-2016-10272)
The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a
left-shift undefined behavior issue, which might allow remote attackers to
cause a denial of service (application crash) or possibly have unspecified
other impact via a crafted image. (CVE-2017-7592)
tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly
initialized, which might allow remote attackers to obtain sensitive
information from process memory via a crafted image. (CVE-2017-7593)
The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF
4.0.7 allows remote attackers to cause a denial of service (memory leak)
via a crafted image. (CVE-2017-7594)
The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote
attackers to cause a denial of service (divide-by-zero error and
application crash) via a crafted image. (CVE-2017-7595)
LibTIFF 4.0.7 has an "outside the range of representable values of type
float" undefined behavior issue, which might allow remote attackers to
cause a denial of service (application crash) or possibly have unspecified
other impact via a crafted image. (CVE-2017-7596)
tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable
values of type float" undefined behavior issue, which might allow remote
attackers to cause a denial of service (application crash) or possibly
have unspecified other impact via a crafted image. (CVE-2017-7597)
tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a
denial of service (divide-by-zero error and application crash) via a
crafted image. (CVE-2017-7598)
LibTIFF 4.0.7 has an "outside the range of representable values of type
short" undefined behavior issue, which might allow remote attackers to
cause a denial of service (application crash) or possibly have unspecified
other impact via a crafted image. (CVE-2017-7599)
LibTIFF 4.0.7 has an "outside the range of representable values of type
unsigned char" undefined behavior issue, which might allow remote
attackers to cause a denial of service (application crash) or possibly
have unspecified other impact via a crafted image. (CVE-2017-7600)
LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long"
undefined behavior issue, which might allow remote attackers to cause a
denial of service (application crash) or possibly have unspecified other
impact via a crafted image. (CVE-2017-7601)
LibTIFF 4.0.7 has a signed integer overflow, which might allow remote
attackers to cause a denial of service (application crash) or possibly
have unspecified other impact via a crafted image. (CVE-2017-7602)
The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the
tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause
a denial of service (out-of-bounds read) via vectors involving the ma
variable. (CVE-2016-3658)
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can
lead to assertion failures in debug mode, or buffer overflows in release
mode, when dealing with unusual tile size like YCbCr with subsampling.
Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
(CVE-2016-9535)
libtiff: out-of-bounds write in multiple tools. (CVE-2014-8128)MGASA-2016-0405mageialibtiffUpdated libtiff packages fix security vulnerability
The updated packages fix:
- A regression introduced by the fix for CVE-2016-9297 (CVE-2016-9448).
- An out-of-bounds Write memcpy and less bound check in tiff2pdf
(CVE-2016-9453).