Unscored CVE-2018-5360 EUVD-2018-17139GHSA-5949-jg6x-h5jp

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function i…

Published Jan 14, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: tiff Package: tiff Ecosystem: Debian Ecosystem: Ubuntu

Description

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	tiff	4.0.6-3	—
Debian 13	tiff	4.0.6-3	—
Debian 12	tiff	4.0.6-3	—

Ubuntu