CVE-2017-13727: Medium severity LibTIFF libtiff vulnerability

Published Aug 29, 2017

Updated

Last updated 24 July 2024

Other sources

There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tifdirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

Affected Software

2 affected componentsFixes available

LibTIFF libtiff=4.0.8

debian/tiff

4.5.0-6+deb12u44.7.0-3+deb13u34.7.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/tiff to a version that resolves this vulnerability.
Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1

Event History

Aug 29, 2017

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4100

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1093-1

Frequently Asked Questions

What is the severity of CVE-2017-13727?

CVE-2017-13727 has a severity rating that indicates it can lead to remote denial of service attacks.

How do I fix CVE-2017-13727?

To fix CVE-2017-13727, upgrade to a patched version of LibTIFF that is newer than 4.0.8.

What software is affected by CVE-2017-13727?

CVE-2017-13727 affects LibTIFF versions 4.0.8 and specific Debian package versions of TIFF.

What happens when CVE-2017-13727 is exploited?

Exploitation of CVE-2017-13727 results in a reachable assertion abort, potentially crashing the application.

Is CVE-2017-13727 specific to any operating system?

CVE-2017-13727 is primarily associated with Debian systems, but any systems using affected LibTIFF versions can be vulnerable.