kritisch
CVE-2017-9117
libtiff: Heap-based buffer over-read in bmp2tiff
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.3CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | tiff | 4.0.7-1 |
| debian 12 | tiff | 4.0.7-1 |
| debian 13 | tiff | 4.0.7-1 |
| debian 14 | tiff | 4.0.7-1 |
| echo | tiff | 4.0.7-1 |
| Red Hat | compat-libtiff3, libtiff, libtiff-devel und 2 weitere | kein Fix angegeben |
| root.io debian 11 | rootio-tiff | 4.0.7-1 |
| root.io debian 12 | rootio-tiff | 4.0.7-1 |
| root.io debian 13 | rootio-tiff | 4.0.7-1 |
| seal Red Hat 7 | libtiff, seal-libtiff | 4.0.3-35.el7+sp8 |
| ubuntu 14.04 | tiff | 4.0.3-7ubuntu0.9 |
| ubuntu 14.04-ESM | tiff | 4.0.3-7ubuntu0.9 |
Alle 19 Einträge aus 14 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | tiff | 4.0.7-1 |
| debian 12 | tiff | 4.0.7-1 |
| debian 13 | tiff | 4.0.7-1 |
| debian 14 | tiff | 4.0.7-1 |
| echo | tiff | 4.0.7-1 |
| Red Hat | compat-libtiff3 | kein Fix angegeben |
| Red Hat | libtiff | kein Fix angegeben |
| Red Hat | libtiff-devel | kein Fix angegeben |
| Red Hat | libtiff-static | kein Fix angegeben |
| Red Hat | libtiff-tools | kein Fix angegeben |
| root.io debian 11 | rootio-tiff | 4.0.7-1 |
| root.io debian 12 | rootio-tiff | 4.0.7-1 |
| root.io debian 13 | rootio-tiff | 4.0.7-1 |
| seal Red Hat 7 | libtiff | 4.0.3-35.el7+sp8 |
| seal Red Hat 7 | seal-libtiff | 4.0.3-35.el7+sp8 |
| ubuntu 14.04 | tiff | 4.0.3-7ubuntu0.9 |
| ubuntu 14.04-ESM | tiff | 4.0.3-7ubuntu0.9 |
| ubuntu 16.04 | tiff | 4.0.6-1ubuntu0.4 |
| ubuntu 16.04-ESM | tiff | 4.0.6-1ubuntu0.4 |
Referenzen
- http://bugzilla.maptools.org/show_bug.cgi?id=2690
- http://www.securityfocus.com/bid/98581
- https://access.redhat.com/security/cve/CVE-2017-9117
- https://gitlab.com/libtiff/libtiff/-/issues/89
- https://nvd.nist.gov/vuln/detail/CVE-2017-9117
- https://ubuntu.com/security/notices/USN-3606-1
- https://usn.ubuntu.com/3606-1/
- https://www.cve.org/CVERecord?id=CVE-2017-9117