CVE-2017-9935
Published: 26 June 2017
In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution.
Notes
| Author | Note |
|---|---|
| ratliff |
reproducer errors out rather than crashing on trusty & zesty |
| sbeattie |
possibly only affects tiff tools, not libtiff itself |
| mdeslaur |
patch in upstream bug we will not be fixing this issue in precise/esm |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
tiff
Launchpad, Ubuntu, Debian |
artful |
Released
(4.0.8-5ubuntu0.1)
|
| trusty |
Released
(4.0.3-7ubuntu0.9)
|
|
| upstream |
Released
(4.0.9-2)
|
|
| xenial |
Released
(4.0.6-1ubuntu0.4)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Ignored
(end of life)
|
|
|
Patches:
upstream: https://gitlab.com/libtiff/libtiff/commit/3dd8f6a357981a4090f126ab9025056c938b6940 upstream: https://gitlab.com/libtiff/libtiff/commit/d4f213636b6f950498a1386083199bd7f65676b9 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |