CVE-2017-11613

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-26T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-01T10:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "99977", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99977"}, {"name": "USN-3606-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/3606-1/"}, {"tags": ["x_refsource_MISC"], "url": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f"}, {"name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1391-1] tiff security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"}, {"name": "DSA-4349", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2018/dsa-4349"}, {"name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-11613", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "99977", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99977"}, {"name": "USN-3606-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3606-1/"}, {"name": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f", "refsource": "MISC", "url": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f"}, {"name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1391-1] tiff security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"}, {"name": "DSA-4349", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4349"}, {"name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:12:40.627Z"}, "title": "CVE Program Container", "references": [{"name": "99977", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99977"}, {"name": "USN-3606-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/3606-1/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f"}, {"name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1391-1] tiff security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"}, {"name": "DSA-4349", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2018/dsa-4349"}, {"name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-11613", "datePublished": "2017-07-26T08:00:00.000Z", "dateReserved": "2017-07-25T00:00:00.000Z", "dateUpdated": "2024-08-05T18:12:40.627Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libtiff:libtiff:4.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "9B3BFA08-D819-4896-8E7B-FEDF1711C407", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer."}, {"lang": "es", "value": "En LibTIFF 4.0.8, existe una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en la funci\u00f3n TIFFOpen. Se podr\u00eda realizar un ataque de denegaci\u00f3n de servicio con una entrada especialmente manipulada. Durante el proceso TIFFOpen, no se verifica td_imagelength. El valor de td_imagelength se puede controlar directamente por un archivo de entrada. En la funci\u00f3n ChopUpSingleUncompressedStrip , se llama a la funci\u00f3n _TIFFCheckMalloc en base a td_imagelength. Si se establece un valor para td_imagelenght cercano a la cantidad de memoria del sistema, el sistema se colgar\u00e1 o se activar\u00e1 el killer OOM."}], "id": "CVE-2017-11613", "lastModified": "2026-06-17T01:02:05.257", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-26T08:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99977"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/3606-1/"}, {"source": "cve@mitre.org", "url": "https://www.debian.org/security/2018/dsa-4349"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99977"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/3606-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2018/dsa-4349"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "libtiff: Memory leak via corrupt td_imagelength in TIFFOpen function", "id": "1475530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1475530"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-20", "details": ["In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer."], "name": "CVE-2017-11613", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "compat-libtiff3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2017-07-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-11613\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-11613"], "statement": "Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details."}

{}