CVE-2017-9815: Medium severity LibTIFF libtiff vulnerability
In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tifdirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function TIFFmalloc in tifunix.c) via a crafted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9815?
CVE-2017-9815 is classified with a severity that can lead to denial of service due to a memory leak.
How do I fix CVE-2017-9815?
To fix CVE-2017-9815, upgrade to tiff package versions 4.2.0-1+deb11u5, 4.2.0-1+deb11u6, 4.5.0-6+deb12u2, 4.5.0-6+deb12u1, or 4.5.1+git230720-5.
Which versions of LibTIFF are affected by CVE-2017-9815?
LibTIFF version 4.0.7 is specifically affected by CVE-2017-9815.
What type of attack does CVE-2017-9815 allow?
CVE-2017-9815 allows attackers to exploit a crafted file to cause a denial of service.
Which operating systems are impacted by CVE-2017-9815?
CVE-2017-9815 impacts Ubuntu 14.04 and 16.04 operating systems using vulnerable versions of LibTIFF.