CVE-2017-13726: Medium severity LibTIFF libtiff vulnerability

Published Aug 29, 2017

Updated

Last updated 24 July 2024

Other sources

There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tifdirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

Affected Software

2 affected componentsFixes available

LibTIFF libtiff=4.0.8

debian/tiff

4.5.0-6+deb12u44.7.0-3+deb13u34.7.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/tiff to a version that resolves this vulnerability.
Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1

Event History

Aug 29, 2017

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4100

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1093-1

Frequently Asked Questions

What is the severity of CVE-2017-13726?

CVE-2017-13726 is classified as a denial of service vulnerability that can cause remote application crashes.

How do I fix CVE-2017-13726?

To fix CVE-2017-13726, upgrade to LibTIFF version 4.2.0-1+deb11u5 or later.

What software is affected by CVE-2017-13726?

CVE-2017-13726 affects LibTIFF version 4.0.8 and certain Debian packages of tiff.

What is the impact of CVE-2017-13726?

The impact of CVE-2017-13726 is that it may lead to a remote denial of service due to a reachable assertion abort.

Can CVE-2017-13726 be exploited remotely?

Yes, CVE-2017-13726 can be exploited remotely by crafting specific input that triggers the vulnerability.