CVE-2018-5784

EUVD-2018-17551 · Published Jan 19, 2018

In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

Technologies

Debian Debian LinuxCanonical Ubuntu LinuxLibtiff Libtiff

Weaknesses

CWE-400

CVSS scores

v3.06.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
v2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Impact

T1190Exploit Public-Facing Application T1499Endpoint Denial of Service

References

http://bugzilla.maptools.org/show_bug.cgi?id=2772
https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef
https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html
https://usn.ubuntu.com/3602-1/
https://usn.ubuntu.com/3606-1/

Potentially impacted assets

See if this affects your attack surface