CVE-2017-5849 tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff....
MediumCVSS 5.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
| netpbm project netpbm | = 10.47.63 | No fix listed |
References
- bugzilla.maptools.org exploit issue-tracking third-party-advisory vdb-entry
- bugzilla.maptools.org exploit issue-tracking third-party-advisory vdb-entry
- [oss-security] 20170202 Re: CVE request: Out-of-Bound read and write issues in put1bitbwtile()(tiff-4.0.7/libtiff/tif-getimage.c:1352) and putgreytile()(tiff-4.0.7/libtiff/tif-getimage.c:1288) mailing-list third-party-advisory
- 96011 vdb-entry
- FEDORA-2017-fa4e441e03 vendor-advisory
- FEDORA-2017-1855c8af2c vendor-advisory
- Debian Security Tracker CVE-2017-5849 vendor-advisory