CVE-2018-17100: Integer Overflow
An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiplyms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a int32 overflow flaw in the multiplyms function in tools/ppm2tiff.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.0.8-2+deb9u5Fixed in 4.0.8-2+deb9u3Fixed in 4.0.9+git181026-1 - Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.2.0-1+deb11u5Fixed in 4.2.0-1+deb11u8Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u2Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17100?
CVE-2018-17100 is classified as a denial of service vulnerability due to an integer overflow leading to a possible crash.
How do I fix CVE-2018-17100?
To mitigate CVE-2018-17100, users should upgrade to the patched versions of LibTIFF or the affected applications as specified by the respective vendors.
What versions are affected by CVE-2018-17100?
CVE-2018-17100 affects LibTIFF version 4.0.9, and certain other specific versions of applications that utilize LibTIFF.
Can CVE-2018-17100 lead to any data loss?
While CVE-2018-17100 primarily causes denial of service, it does not explicitly indicate potential data loss but could disrupt normal operations.
Is there an exploit available for CVE-2018-17100?
Currently, there is no known public exploit for CVE-2018-17100, but it is advisable to apply updates to prevent potential attacks.