National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2017-11613 Detail

Current Description

In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.

Source:  MITRE
View Analysis Description

Severity



CVSS 3.x Severity and Metrics:

NIST CVSS score
NIST: NVD
Base Score: 6.5 MEDIUM
Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://www.securityfocus.com/bid/99977 Third Party Advisory VDB Entry
https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html
https://usn.ubuntu.com/3606-1/
https://www.debian.org/security/2018/dsa-4349

Weakness Enumeration

CWE-ID CWE Name Source
CWE-20 Improper Input Validation NIST  

Known Affected Software Configurations Switch to CPE 2.3

Configuration 1 ( hide )
 cpe:/a:libtiff:libtiff:4.0.8
     Show Matching CPE(s)


Change History

6 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2017-11613
NVD Published Date:
07/26/2017
NVD Last Modified:
12/01/2018