CVE-2017-7600: Input Validation
Last updated 25 August 2025
Other sources
LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1 - Compensating control
Apply network-layer protections to limit exposure of any services that parse user-supplied or untrusted TIFF images, since crafted images can trigger a LibTIFF 4.0.7 issue that may lead to denial of service (application crash).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7600?
The severity of CVE-2017-7600 is typically classified as high due to the potential for denial of service attacks.
How do I fix CVE-2017-7600?
To fix CVE-2017-7600, upgrade to a patched version of LibTIFF, specifically version 4.2.0-1+deb11u7 or later.
What systems are affected by CVE-2017-7600?
CVE-2017-7600 affects LibTIFF version 4.0.7 and may impact applications using this library.
What is the potential impact of CVE-2017-7600?
The potential impact of CVE-2017-7600 includes application crashes and possible remote exploitation via crafted images.
Is CVE-2017-7600 still a risk?
CVE-2017-7600 remains a risk for systems that have not been updated to address the vulnerability.