CVE-2017-9936: Medium severity LibTIFF libtiff vulnerability
In LibTIFF 4.0.8, there is a memory leak in tifjbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1 - Upgrade
Upgrade
LibTIFFto a version that resolves this vulnerability.Fixed in 4.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9936?
CVE-2017-9936 is classified as a denial of service vulnerability due to memory leaks.
How do I fix CVE-2017-9936?
To mitigate CVE-2017-9936, upgrade to the fixed versions 4.2.0-1+deb11u5, 4.2.0-1+deb11u6, 4.5.0-6+deb12u2, 4.5.0-6+deb12u1, or 4.5.1+git230720-5.
Which software is affected by CVE-2017-9936?
CVE-2017-9936 affects LibTIFF version 4.0.8 and various Debian and Ubuntu packages that use this version.
Can CVE-2017-9936 be exploited remotely?
Yes, a crafted TIFF document can be used to exploit CVE-2017-9936, potentially leading to a remote denial of service attack.
What are the symptoms of CVE-2017-9936 exploitation?
The exploitation of CVE-2017-9936 may result in excessive memory usage, leading to application crashes or system instability.