CVE-2017-9147

Published: 22 May 2017

LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.

Notes

reproducer errors out on precise, trusty rather than crashing

same problem as CVE-2015-7554

Priority

Negligible

CVSS 3 base score: 6.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9147
• https://ubuntu.com/security/notices/USN-3606-1
• NVD
• Launchpad
• Debian

Bugs

• http://bugzilla.maptools.org/show_bug.cgi?id=2693
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863185
• http://bugzilla.maptools.org/show_bug.cgi?id=2580