PT-2018-16917 · Libtiff+2 · Libtiff+2

Probe Fuzzer · Published 2018-01-14 · Updated 2019-04-22 · CVE-2018-5360

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions prior to 4.0.6 GraphicsMagick version 1.3.27

Description The issue is related to the mishandling of TIFF files, specifically a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c.

Recommendations For LibTIFF versions prior to 4.0.6, update to version 4.0.6 or later. For GraphicsMagick version 1.3.27, consider disabling the ReadTIFFImage function in coders/tiff.c until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1628

CVE-2018-5360

Affected Products

Alt Linux

Graphicsmagick

Libtiff

References · 105

• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2500 · Exploit
• 🔥 https://sourceforge.net/p/graphicsmagick/bugs/540 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3624 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14973 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5360 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00539 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Security Note
• https://bdu.fstec.ru/vul/2017-00883 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960 · Security Note
• https://bdu.fstec.ru/vul/2017-00330 · Security Note