REDHAT-BUG-1631069
First published: Wed Sep 19 2018(Updated: )
An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. Upstream issue: <a href="http://bugzilla.maptools.org/show_bug.cgi?id=2810">http://bugzilla.maptools.org/show_bug.cgi?id=2810</a> Upstream patch: <a href="https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=6da1fb3f64d43be37e640efbec60400d1f1ac39e">https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=6da1fb3f64d43be37e640efbec60400d1f1ac39e</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libtiff |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.maptools.org/show_bug.cgi?id=2810
- https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=6da1fb3f64d43be37e640efbec60400d1f1ac39e
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1631070
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1631072
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1631071
- https://access.redhat.com/errata/RHSA-2019:2053
- https://access.redhat.com/security/cve/cve-2018-17100
- https://bugzilla.redhat.com/show_bug.cgi?id=1631069
Frequently Asked Questions
What is the nature of REDHAT-BUG-1631069?
REDHAT-BUG-1631069 is a vulnerability in LibTIFF 4.0.9 involving an int32 overflow that can lead to denial of service or other unspecified impacts when processing crafted image files.
What impact can REDHAT-BUG-1631069 have on my systems?
The impact of REDHAT-BUG-1631069 can result in application crashes and may allow attackers to exploit the vulnerability for further unspecified consequences.
How can I mitigate the risk associated with REDHAT-BUG-1631069?
To mitigate REDHAT-BUG-1631069, update to the latest patched version of LibTIFF that addresses the int32 overflow vulnerability.
Is REDHAT-BUG-1631069 present in all versions of LibTIFF?
REDHAT-BUG-1631069 specifically affects LibTIFF version 4.0.9; other versions may not be impacted.
What kind of crafted files trigger the vulnerability in REDHAT-BUG-1631069?
The vulnerability in REDHAT-BUG-1631069 can be triggered by crafted image files processed by the LibTIFF library.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-17100
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/libtiff
- canonical/libtiff