CVE-2018-15209

Red Hat statement

Red Hat has determined that this vulnerability has a moderate severity due to a series of factors. Firstly, the attack vector necessary to successfully exploit this flaw is local, given that the attacker must rely on user interaction (by tricking or fooling them into opening a maliciously-crafted TIFF file). Secondly, the CIA impact of this vulnerability should be assumed to be Low for all three vectors, due to to the fact that a successful crash would only impact the LibTIFF application itself, the application does not inherently have access to nor handle sensitive or confidential information, and since it causes a DoS due to heap-based buffer overflow there is little indication that this will modify or alter data. This issue did not affect the versions of libtiff as shipped with Red Hat Enterprise Linux 5, 6, and 7.