CVE-2017-9936

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a...

6.5 MediumPublic exploitFix available

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

7.48%Down 0.7 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-772
Updated: 2026-11-02

CVE List No score

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: CVE-2017-9936
Updated: 2026-11-02

EUVDEUVD-2017-18846 No score

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: EUVD-2017-18846
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5ffm-f598-q72q 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a...

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: GHSA-5ffm-f598-q72q
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-772
Updated: 2026-11-02

OSVALPINE-CVE-2017-9936 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: ALPINE-CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2017-9936 6.5

CVE-2017-9936 does not affect BellSoft software

Record: BELL-CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSV 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-9936 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: DEBIAN-CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-9936 6.5

In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack.

Record: UBUNTU-CVE-2017-9936
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2017-0210 No score

Updated libtiff packages fix security vulnerabilities

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code (CVE-2017-9936, CVE-2017-10688).

Record: MGASA-2017-0210
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11461-1 No score

libtiff-devel-32bit-4.3.0-1.3 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.3.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11461-1
Updated: 2026-11-02

OSVUSN-3602-1 No score

tiff vulnerabilities

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Record: USN-3602-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tiff` Alpine:v3.10	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.11	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.12	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.13	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.14	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.15	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.16	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.17	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.18	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.19	before 4.0.8-r1	4.0.8-r1

Show 23 moreShow less

Affected packages
Package	Affected	Fixed
`tiff` Alpine:v3.20	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.21	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.22	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.23	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.24	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.3	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.4	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.5	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.6	before 4.0.8-r0	4.0.8-r0
`tiff` Alpine:v3.7	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.8	before 4.0.8-r1	4.0.8-r1
`tiff` Alpine:v3.9	before 4.0.8-r1	4.0.8-r1
`tiff` Debian:12	before 4.0.8-3	4.0.8-3
`tiff` Debian:13	before 4.0.8-3	4.0.8-3
`tiff` Debian:14	before 4.0.8-3	4.0.8-3
`tiff` Debian:7	before 4.0.2-6+deb7u15, plus listed versions 4.0.2-64.0.2-6+deb7u14.0.2-6+deb7u104.0.2-6+deb7u114.0.2-6+deb7u12 Show 10 moreShow less 4.0.2-6+deb7u134.0.2-6+deb7u144.0.2-6+deb7u24.0.2-6+deb7u34.0.2-6+deb7u44.0.2-6+deb7u54.0.2-6+deb7u64.0.2-6+deb7u74.0.2-6+deb7u84.0.2-6+deb7u9	4.0.2-6+deb7u15
`tiff3` Debian:7	before 3.9.6-11+deb7u7, plus listed versions 3.9.6-113.9.6-11+deb7u13.9.6-11+deb7u23.9.6-11+deb7u33.9.6-11+deb7u43.9.6-11+deb7u53.9.6-11+deb7u6	3.9.6-11+deb7u7
`tiff` Debian:8	before 4.0.3-12.3+deb8u4, plus listed versions 4.0.3-12.34.0.3-12.3+deb8u14.0.3-12.3+deb8u24.0.3-12.3+deb8u3	4.0.3-12.3+deb8u4
`tiff` Debian:9	before 4.0.8-2+deb9u1, plus listed versions 4.0.8-2	4.0.8-2+deb9u1
`libtiff` Mageia:5	before 4.0.8-1.1.mga5	4.0.8-1.1.mga5
`tiff` Ubuntu:14.04:LTS	before 4.0.3-7ubuntu0.8, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 6 moreShow less 4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.7	4.0.3-7ubuntu0.8
`tiff` Ubuntu:16.04:LTS	before 4.0.6-1ubuntu0.3, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2	4.0.6-1ubuntu0.3
`tiff` openSUSE:Tumbleweed	before 4.3.0-1.3	4.3.0-1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LibTIFF - 'tif_jbig.c' Denial of Service	2017-07-06

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9936 is a medium vulnerability (CVSS 6.5) in Libtiff, published June 26, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.48%, the 94th percentile. Fixed in tiff 4.0.8-r1.

References

Show 83 moreShow less