CVE-2017-16232
First published: Thu Mar 21 2019(Updated: )
** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libtiff Libtiff | =4.0.8 | |
| openSUSE Leap | =42.2 | |
| openSUSE Leap | =42.3 | |
| SUSE Linux Enterprise Desktop | =12-sp2 | |
| SUSE Linux Enterprise Desktop | =12-sp3 | |
| SUSE Linux Enterprise Server | =12-sp2 | |
| SUSE Linux Enterprise Server | =12-sp2 | |
| SUSE Linux Enterprise Server | =12-sp3 | |
| SUSE Linux Enterprise Software Development Kit | =12-sp2 | |
| SUSE Linux Enterprise Software Development Kit | =12-sp3 | |
| =4.0.8 | ||
| =42.2 | ||
| =42.3 | ||
| =12-sp2 | ||
| =12-sp3 | ||
| =12-sp2 | ||
| =12-sp2 | ||
| =12-sp3 | ||
| =12-sp2 | ||
| =12-sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html
- http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html
- http://seclists.org/fulldisclosure/2018/Dec/32
- http://seclists.org/fulldisclosure/2018/Dec/47
- http://www.openwall.com/lists/oss-security/2017/11/01/11
- http://www.openwall.com/lists/oss-security/2017/11/01/3
- http://www.openwall.com/lists/oss-security/2017/11/01/7
- http://www.openwall.com/lists/oss-security/2017/11/01/8
- http://www.securityfocus.com/bid/101696
Frequently Asked Questions
What is the vulnerability ID for this LibTIFF vulnerability?
The vulnerability ID for this LibTIFF vulnerability is CVE-2017-16232.
What is the severity of CVE-2017-16232?
CVE-2017-16232 has a severity rating of high.
What is the affected software for CVE-2017-16232?
The affected software for CVE-2017-16232 includes LibTIFF 4.0.8, openSUSE Leap 42.2 and 42.3, SUSE Linux Enterprise Desktop 12-sp2 and 12-sp3, SUSE Linux Enterprise Server 12-sp2 and 12-sp3, and SUSE Linux Enterprise Software Development Kit 12-sp2 and 12-sp3.
How does CVE-2017-16232 allow attackers to cause a denial of service?
CVE-2017-16232 allows attackers to cause a denial of service by exploiting multiple memory leak vulnerabilities in LibTIFF 4.0.8.
Is CVE-2017-16232 easy to reproduce?
Third parties were unable to reproduce the issue of CVE-2017-16232.
- agent/references
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- collector/nvd-api
- source/NVD
- status/disputed
- vendor/libtiff
- canonical/libtiff libtiff
- version/libtiff libtiff/4.0.8
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.2
- version/opensuse leap/42.3
- vendor/suse
- canonical/suse linux enterprise desktop
- version/suse linux enterprise desktop/12-sp2
- version/suse linux enterprise desktop/12-sp3
- canonical/suse linux enterprise server
- version/suse linux enterprise server/12-sp2
- version/suse linux enterprise server/12-sp3
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/12-sp2
- version/suse linux enterprise software development kit/12-sp3