PT-2018-16917 · Libtiff+2 · Libtiff+2

Probe Fuzzer · Publicado 2018-01-14 · Atualizado 2019-04-22 · CVE-2018-5360

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions prior to 4.0.6 GraphicsMagick version 1.3.27

Description The issue is related to the mishandling of TIFF files, specifically a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c.

Recommendations For LibTIFF versions prior to 4.0.6, update to version 4.0.6 or later. For GraphicsMagick version 1.3.27, consider disabling the ReadTIFFImage function in coders/tiff.c until a patch is available.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2019-1628

CVE-2018-5360

Produtos afetados

Alt Linux

Graphicsmagick

Libtiff

Referências · 105

• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2500 · Exploit
• 🔥 https://sourceforge.net/p/graphicsmagick/bugs/540 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3624 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14973 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/04/08/4 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-5360 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5360 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00539 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/01/24/16 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-00883 · Nota de Segurança