{"id":"CVE-2017-17973","aliases":["BELL-CVE-2017-17973","EUVD-2017-9115","GHSA-pf49-rpj2-8mg3","ROOT-OS-DEBIAN-12-CVE-2017-17973","SUSE-SU-2018:1179-1","SUSE-SU-2018:1180-1","UBUNTU-CVE-2017-17973"],"status":"disputed","title":"** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc...","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03051,"percentile":0.87662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2017-12-29T21:00:00Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Root:Debian:12","package":"tiff","fixed_in":["4.5.0-6+deb12u4.aikido.20","4.5.0-6+deb12u4.root.io.19","4.5.0-6+deb12u4.aikido.21","4.5.0-6+deb12u4.aikido.22"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-tiff","fixed_in":["4.5.0-6+deb12u4.aikido.20","4.5.0-6+deb12u4.root.io.19","4.5.0-6+deb12u4.aikido.21","4.5.0-6+deb12u4.aikido.22"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Root:Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-6+deb12u4.aikido.20"},{"fixed":"4.5.0-6+deb12u4.root.io.19"},{"fixed":"4.5.0-6+deb12u4.aikido.21"},{"fixed":"4.5.0-6+deb12u4.aikido.22"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-6+deb12u4.aikido.20"},{"fixed":"4.5.0-6+deb12u4.root.io.19"},{"fixed":"4.5.0-6+deb12u4.aikido.21"},{"fixed":"4.5.0-6+deb12u4.aikido.22"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5","4.0.3-7ubuntu0.11+esm6","4.0.3-7ubuntu0.11+esm7","4.0.3-7ubuntu0.11+esm8","4.0.3-7ubuntu0.11+esm9","4.0.3-7ubuntu0.11+esm10","4.0.3-7ubuntu0.11+esm11","4.0.3-7ubuntu0.11+esm12","4.0.3-7ubuntu0.11+esm13","4.0.3-7ubuntu0.11+esm14","4.0.3-7ubuntu0.11+esm15","4.0.3-7ubuntu0.11+esm16","4.0.3-7ubuntu0.11+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8","4.0.6-1ubuntu0.8+esm9","4.0.6-1ubuntu0.8+esm10","4.0.6-1ubuntu0.8+esm11","4.0.6-1ubuntu0.8+esm12","4.0.6-1ubuntu0.8+esm13","4.0.6-1ubuntu0.8+esm14","4.0.6-1ubuntu0.8+esm15","4.0.6-1ubuntu0.8+esm16","4.0.6-1ubuntu0.8+esm17","4.0.6-1ubuntu0.8+esm18","4.0.6-1ubuntu0.8+esm19","4.0.6-1ubuntu0.8+esm20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2","4.0.9-5ubuntu0.3","4.0.9-5ubuntu0.4","4.0.9-5ubuntu0.5","4.0.9-5ubuntu0.6","4.0.9-5ubuntu0.7","4.0.9-5ubuntu0.8","4.0.9-5ubuntu0.9","4.0.9-5ubuntu0.10","4.0.9-5ubuntu0.10+esm1","4.0.9-5ubuntu0.10+esm2","4.0.9-5ubuntu0.10+esm3","4.0.9-5ubuntu0.10+esm4","4.0.9-5ubuntu0.10+esm5","4.0.9-5ubuntu0.10+esm6","4.0.9-5ubuntu0.10+esm7","4.0.9-5ubuntu0.10+esm8","4.0.9-5ubuntu0.10+esm9","4.0.9-5ubuntu0.10+esm10"]}],"products":[{"vendor":"libtiff","product":"libtiff"}],"references":[{"url":"http://bugzilla.maptools.org/show_bug.cgi?id=2769","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=1074318","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/102331","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1530912","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17973"},{"url":"https://github.com/advisories/GHSA-pf49-rpj2-8mg3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-17973","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007280","tags":["report"]},{"url":"https://bugzilla.suse.com/1011107","tags":["report"]},{"url":"https://bugzilla.suse.com/1011845","tags":["report"]},{"url":"https://bugzilla.suse.com/1017688","tags":["report"]},{"url":"https://bugzilla.suse.com/1017690","tags":["report"]},{"url":"https://bugzilla.suse.com/1017691","tags":["report"]},{"url":"https://bugzilla.suse.com/1017692","tags":["report"]},{"url":"https://bugzilla.suse.com/1031255","tags":["report"]},{"url":"https://bugzilla.suse.com/1046077","tags":["report"]},{"url":"https://bugzilla.suse.com/1048937","tags":["report"]},{"url":"https://bugzilla.suse.com/1074318","tags":["report"]},{"url":"https://bugzilla.suse.com/960341","tags":["report"]},{"url":"https://bugzilla.suse.com/983436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181180-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1081690","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5784","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-17973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17973","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17973","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","status":"disputed","published":"2017-12-29T21:00:00Z","modified":"2024-08-05T21:06:49.813Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-9115","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","status":"published","published":"2017-12-29T21:00:00Z","modified":"2024-08-05T21:06:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:23:08.049216Z"}],"ghsa":[{"id":"GHSA-pf49-rpj2-8mg3","title":"** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc...","description":"** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.","status":"published","published":"2022-05-14T03:45:22Z","modified":"2023-02-03T05:00:31Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:52:48.49301Z"}],"nvd":[{"id":"CVE-2017-17973","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","status":"disputed","published":"2017-12-29T21:29:00.19Z","modified":"2026-06-17T01:11:58.61Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"BELL-CVE-2017-17973","title":"CVE-2017-17973 does not affect BellSoft software","status":"withdrawn","published":"2017-12-29T21:29:00Z","modified":"2026-09-06T07:15:07.948345505Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-17973","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","status":"published","published":"2017-12-29T21:29:00.19Z","modified":"2026-10-24T10:30:36.308552353Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"UBUNTU-CVE-2017-17973","description":"In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue","status":"published","published":"2017-12-29T21:29:00Z","modified":"2026-04-22T11:21:22.374796Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2017-17973","title":"CVE-2017-17973 in tiff - Patched by Root","description":"Root has patched CVE-2017-17973 in the tiff package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:45:33Z","modified":"2026-09-02T14:00:11.706322889Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"SUSE-SU-2018:1179-1","title":"Security update for tiff","description":"\n  \nThis update for tiff fixes the following issues:\n\n- CVE-2016-9453: The t2p_readwrite_pdf_image_tile function allowed remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one (bsc#1011107).\n- CVE-2016-5652: An exploitable heap-based buffer overflow existed in the handling of TIFF images in the TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means (bsc#1007280).\n- CVE-2017-11335: There is a heap based buffer overflow in tools/tiff2pdf.c via a PlanarConfig=Contig image, which caused a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack (bsc#1048937).\n- CVE-2016-9536: tools/tiff2pdf.c had an out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka 't2p_process_jpeg_strip heap-buffer-overflow.'  (bsc#1011845)\n- CVE-2017-9935: In LibTIFF, there was a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution (bsc#1046077).\n- CVE-2017-17973: There is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)\n- CVE-2015-7554: The _TIFFVGetField function in tif_dir.c allowed attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image (bsc#960341).\n- CVE-2016-5318: Stack-based buffer overflow in the _TIFFVGetField function allowed remote attackers to crash the application via a crafted tiff (bsc#983436).\n- CVE-2016-10095: Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c allowed remote attackers to cause a denial of service (crash) via a crafted TIFF file (bsc#1017690,).\n- CVE-2016-10268: tools/tiffcp.c allowed remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 78490' and libtiff/tif_unix.c:115:23 (bsc#1031255)\n- An overlapping of memcpy parameters was fixed which could lead to content corruption (bsc#1017691).\n- Fixed an invalid memory read which could lead to a crash (bsc#1017692).\n- Fixed a NULL pointer dereference in TIFFReadRawData (tiffinfo.c) that could crash the decoder (bsc#1017688).\n","status":"published","published":"2018-05-09T12:01:09Z","modified":"2025-05-02T04:04:45.690002Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1180-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2017-9935: There was a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution (bsc#1046077)\n- CVE-2017-17973: There is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)\n- CVE-2018-5784: There is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries (bsc#1081690)\n\n","status":"published","published":"2018-05-09T12:01:44Z","modified":"2026-02-04T04:01:43.824738Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}