libtiff: NULL pointer dereference in function _TIFFmemcmp at tif_unix.c
Published Sep 13, 2018
6.5
MEDIUMCVSS 3.0
EPSS 3.25%
Description
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Affected products
No data.
Configuration 2
- 8.0
Configuration 3
- 14.04
- 16.04
- 18.04
- 18.10
No data.
Red Hat Enterprise Linux 5
libtiff
Not affected
Red Hat Enterprise Linux 6
libtiff
Not affected
Red Hat Enterprise Linux 7
compat-libtiff3
Not affected
Red Hat Enterprise Linux 7
libtiff
Not affected
Red Hat Enterprise Linux 8
libtiff
Not affected
Red Hat Enterprise Linux 8
mingw-libtiff
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | libtiff | Not affected | n/a |
| Red Hat Enterprise Linux 6 | libtiff | Not affected | n/a |
| Red Hat Enterprise Linux 7 | compat-libtiff3 | Not affected | n/a |
| Red Hat Enterprise Linux 7 | libtiff | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libtiff | Not affected | n/a |
| Red Hat Enterprise Linux 8 | mingw-libtiff | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (11)
- http://bugzilla.maptools.org/show_bug.cgi?id=2811 x_refsource_MISCExploitIssue TrackingThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html vendor-advisoryx_refsource_SUSE
- http://www.securityfocus.com/bid/105342 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2018-17000 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1630004 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-8784 Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html mailing-listx_refsource_MLISTThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-17000
- https://usn.ubuntu.com/3906-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-17000
- https://www.debian.org/security/2020/dsa-4670 vendor-advisoryx_refsource_DEBIAN
| Link | Providers | Tags |
|---|---|---|
| http://bugzilla.maptools.org/show_bug.cgi?id=2811 | x_refsource_MISCExploitIssue TrackingThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html | vendor-advisoryx_refsource_SUSE | |
| http://www.securityfocus.com/bid/105342 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/security/cve/CVE-2018-17000 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1630004 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-8784 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html | mailing-listx_refsource_MLISTThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-17000 | ||
| https://usn.ubuntu.com/3906-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2018-17000 | ||
| https://www.debian.org/security/2020/dsa-4670 | vendor-advisoryx_refsource_DEBIAN |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data