CVE-2017-18013: Null Pointer Dereference
In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tifprint.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a NULL pointer dereference in the TIFFPrintDirectory function in tifprint.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18013?
CVE-2017-18013 is classified as a denial of service vulnerability due to a null pointer dereference.
How do I fix CVE-2017-18013?
To fix CVE-2017-18013, update LibTIFF to version 4.0.10 or later, or apply the appropriate patches provided by the vendor.
Which software is affected by CVE-2017-18013?
CVE-2017-18013 affects LibTIFF versions prior to 4.0.10 and certain versions of IBM Cognos Analytics and Debian TIFF packages.
What kind of impact can CVE-2017-18013 have on a system?
CVE-2017-18013 can cause a denial of service, leading to application crashes when handling TIFF files.
Is there a known exploit for CVE-2017-18013?
There are no public exploits for CVE-2017-18013, but it is advisable to mitigate the risk by applying updates.