CVE-2017-11613: Input Validation
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, tdimagelength is not checked. The value of tdimagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the TIFFCheckMalloc function is called based on tdimagelength. If we set the value of tdimagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a flaw in the TIFFOpen function. By using a specially-crafted file, an attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.0.9-5Fixed in 4.0.8-2+deb9u3Fixed in 4.0.8-2+deb9u4 - Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11613?
CVE-2017-11613 has a severity rating that indicates it can lead to a denial of service attack.
How do I fix CVE-2017-11613?
To fix CVE-2017-11613, upgrade to a patched version of the affected software, such as LibTIFF 4.0.9 or newer.
Which versions of LibTIFF are affected by CVE-2017-11613?
LibTIFF versions earlier than 4.0.9, specifically 4.0.8, are affected by CVE-2017-11613.
Is CVE-2017-11613 present in any IBM Cognos Analytics products?
Yes, CVE-2017-11613 is present in multiple versions of IBM Cognos Analytics prior to the patches provided.
What kind of attack can be executed due to CVE-2017-11613?
CVE-2017-11613 allows an attacker to perform a denial of service attack through crafted TIFF input.