CVE-2017-16232

moderate-risk

Published 2019-03-21

LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue

Do I need to act?

1.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (10)

Libtiff

Leap

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Affected Vendors

Suse Libtiff Opensuse

References (20)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html

Third Party Advisory http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html

Mailing List http://seclists.org/fulldisclosure/2018/Dec/32

Mailing List http://seclists.org/fulldisclosure/2018/Dec/47

Mailing List http://www.openwall.com/lists/oss-security/2017/11/01/11

Mailing List http://www.openwall.com/lists/oss-security/2017/11/01/3

Mailing List http://www.openwall.com/lists/oss-security/2017/11/01/7

Mailing List http://www.openwall.com/lists/oss-security/2017/11/01/8

Third Party Advisory http://www.securityfocus.com/bid/101696