CVE-2017-5225: Buffer Overflow

Published Jan 12, 2017

Updated

LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.

Affected Software

2 affected componentsFixes available

LibTIFF libtiff=4.0.7

debian/tiff

4.5.0-6+deb12u44.7.0-3+deb13u34.7.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/tiff to a version that resolves this vulnerability.
Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1

Event History

Jan 12, 2017

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Data Sourced

via NVD·11:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-3844

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-795-1

Frequently Asked Questions

What is the severity of CVE-2017-5225?

CVE-2017-5225 is classified as a high-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2017-5225?

To fix CVE-2017-5225, upgrade to LibTIFF version 4.0.8 or later where the vulnerability has been patched.

What causes the CVE-2017-5225 vulnerability?

CVE-2017-5225 is caused by a heap buffer overflow in the tiffcp tool when processing a crafted BitsPerSample value.

What are the potential impacts of CVE-2017-5225?

The potential impacts of CVE-2017-5225 include denial of service (DoS) and the execution of arbitrary code.

Which versions of LibTIFF are affected by CVE-2017-5225?

CVE-2017-5225 affects LibTIFF version 4.0.7 specifically.