CVE-2017-9117
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in...
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
CVE-2017-9117- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2017-18055
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
EUVD-2017-18055- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v898-4vh8-7f99
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in...
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
- Record
GHSA-v898-4vh8-7f99- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
CVE-2017-9117- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
CVE-2017-9117- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-9117
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
DEBIAN-CVE-2017-9117- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-9117
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
- Record
UBUNTU-CVE-2017-9117- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1757666692 No score
libtiff: Fix of CVE-2017-9117
- CVE-2017-9117: add checks for all BMP reading operations to avoid buffer overflow
- Record
CLSA-2025-1757666692- Updated
- 2026-11-02
OSVSUSE-SU-2018:3879-1 No score
Security update for tiff
This update for tiff fixes the following issues:
Security issues fixed:
- CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672).
- CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257).
- CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322).
- CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080).
- CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186).
- CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163).
- CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440).
- CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448).
- CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447)
- CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446)
- CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461).
Non-security issues fixed:
- asan_build: build ASAN included
- debug_build: build more suitable for debugging
- Record
SUSE-SU-2018:3879-1- Updated
- 2026-11-02
OSVUSN-3606-1 No score
tiff vulnerabilities
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
- Record
USN-3606-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libtiffTuxCare:CentOS:7 |
before 4.0.3-35.el7.tuxcare.els3 | 4.0.3-35.el7.tuxcare.els3 |
libtiff-develTuxCare:CentOS:7 |
before 4.0.3-35.el7.tuxcare.els3 | 4.0.3-35.el7.tuxcare.els3 |
libtiff-staticTuxCare:CentOS:7 |
before 4.0.3-35.el7.tuxcare.els3 | 4.0.3-35.el7.tuxcare.els3 |
libtiff-toolsTuxCare:CentOS:7 |
before 4.0.3-35.el7.tuxcare.els3 | 4.0.3-35.el7.tuxcare.els3 |
tiffDebian:12 |
before 4.0.7-1 | 4.0.7-1 |
tiffDebian:13 |
before 4.0.7-1 | 4.0.7-1 |
tiffDebian:14 |
before 4.0.7-1 | 4.0.7-1 |
tiffSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 11 CVEs |
before 3.8.2-141.169.22.1 | 3.8.2-141.169.22.1 |
tiffSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 11 CVEs |
before 3.8.2-141.169.22.1 | 3.8.2-141.169.22.1 |
tiffSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 11 CVEs |
before 3.8.2-141.169.22.1 | 3.8.2-141.169.22.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tiffUbuntu:14.04:LTS |
before 4.0.3-7ubuntu0.9, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 7 moreShow less4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.8 |
4.0.3-7ubuntu0.9 |
tiffUbuntu:16.04:LTS |
before 4.0.6-1ubuntu0.4, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.24.0.6-1ubuntu0.3 |
4.0.6-1ubuntu0.4 |
tiffUbuntu:14.04:LTS From an advisory covering 12 CVEs |
before 4.0.3-7ubuntu0.9, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 7 moreShow less4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.8 |
4.0.3-7ubuntu0.9 |
tiffUbuntu:16.04:LTS From an advisory covering 12 CVEs |
before 4.0.6-1ubuntu0.4, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.24.0.6-1ubuntu0.3 |
4.0.6-1ubuntu0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9117 is a medium vulnerability (CVSS 4.0) in Libtiff, published May 21, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in libtiff 4.0.3-35.el7.tuxcare.els3.
References
usn.ubuntu.com/3606-1
securityfocus.com/bid/98581
bugzilla.maptools.org/show_bug.cgi?id=2690
gitlab.com/libtiff/libtiff/-/issues/89
nvd.nist.gov/vuln/detail/CVE-2017-9117
github.com/advisories/GHSA-v898-4vh8-7f99
Show 39 moreShow less
errata.tuxcare.com/els_os/centos7els/CLSA-2025-1757666692.html
security-tracker.debian.org/tracker/CVE-2017-9117
suse.com/support/update/announcement/2018/suse-su-20183879-1
bugzilla.suse.com/1010163
ubuntu.com/security/CVE-2017-9117
cve.org/CVERecord?id=CVE-2017-9117