CVE-2017-9935
Published: 26 June 2017
In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution.
Notes
| Author | Note |
|---|---|
| ratliff | reproducer errors out rather than crashing on trusty & zesty |
| sbeattie | possibly only affects tiff tools, not libtiff itself |
| mdeslaur | patch in upstream bug we will not be fixing this issue in precise/esm |
Priority
CVSS 3 base score: 8.8
Status
| Package | Release | Status |
|---|---|---|
|
tiff Launchpad, Ubuntu, Debian |
artful |
Released
(4.0.8-5ubuntu0.1)
|
| precise |
Ignored
|
|
| trusty |
Released
(4.0.3-7ubuntu0.9)
|
|
| upstream |
Released
(4.0.9-2)
|
|
| xenial |
Released
(4.0.6-1ubuntu0.4)
|
|
| yakkety |
Ignored
(reached end-of-life)
|
|
| zesty |
Ignored
(reached end-of-life)
|
|
|
Patches: upstream: https://gitlab.com/libtiff/libtiff/commit/3dd8f6a357981a4090f126ab9025056c938b6940 upstream: https://gitlab.com/libtiff/libtiff/commit/d4f213636b6f950498a1386083199bd7f65676b9 |
||