{"id":"CVE-2017-18013","aliases":["ALPINE-CVE-2017-18013","BELL-CVE-2017-18013","DEBIAN-CVE-2017-18013","DLA-1259-1","DLA-1260-1","DSA-4100-1","EUVD-2017-9153","GHSA-cp7r-wf78-8x92","MGASA-2018-0109","SUSE-SU-2018:1472-1","SUSE-SU-2018:1826-1","SUSE-SU-2018:1889-1","UBUNTU-CVE-2017-18013","USN-3602-1","USN-3606-1","openSUSE-SU-2024:11461-1"],"status":"published","title":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory...","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02924,"percentile":0.87133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-01-01T00:00:00Z","modified":"2026-10-24T14:03:20Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"tiff","fixed_in":["4.0.9-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.0.9-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.0.9-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.0.9-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"tiff","fixed_in":["4.0.2-6+deb7u18"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"tiff3","fixed_in":["3.9.6-11+deb7u9"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tiff","fixed_in":["4.0.3-7ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tiff","fixed_in":["4.0.6-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-6+deb7u18"}]}],"versions":["4.0.2-6","4.0.2-6+deb7u1","4.0.2-6+deb7u10","4.0.2-6+deb7u11","4.0.2-6+deb7u12","4.0.2-6+deb7u13","4.0.2-6+deb7u14","4.0.2-6+deb7u15","4.0.2-6+deb7u16","4.0.2-6+deb7u17","4.0.2-6+deb7u2","4.0.2-6+deb7u3","4.0.2-6+deb7u4","4.0.2-6+deb7u5","4.0.2-6+deb7u6","4.0.2-6+deb7u7","4.0.2-6+deb7u8","4.0.2-6+deb7u9"]},{"source":"osv","ecosystem":"Debian:7","package":"tiff3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-11+deb7u9"}]}],"versions":["3.9.6-11","3.9.6-11+deb7u1","3.9.6-11+deb7u2","3.9.6-11+deb7u3","3.9.6-11+deb7u4","3.9.6-11+deb7u5","3.9.6-11+deb7u6","3.9.6-11+deb7u7","3.9.6-11+deb7u8"]},{"source":"osv","ecosystem":"Debian:8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-12.3+deb8u5"}]}],"versions":["4.0.3-12.3","4.0.3-12.3+deb8u1","4.0.3-12.3+deb8u2","4.0.3-12.3+deb8u3","4.0.3-12.3+deb8u4"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-2+deb9u2"}]}],"versions":["4.0.8-2","4.0.8-2+deb9u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-1.1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.15.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.15.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.15.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.15.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.8"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.3"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.8"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7"],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.3"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2"],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.9"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.4"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.3"}]}],"bundled":48}],"products":[{"vendor":"libtiff","product":"libtiff"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00033.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/3606-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00034.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://usn.ubuntu.com/3602-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/102345","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4100","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://bugzilla.maptools.org/show_bug.cgi?id=2770","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18013"},{"url":"https://github.com/advisories/GHSA-cp7r-wf78-8x92"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-18013","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-18013","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18013","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0109.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22120","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/12/02/1","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-01/msg00041.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017694","tags":["report"]},{"url":"https://bugzilla.suse.com/1031250","tags":["report"]},{"url":"https://bugzilla.suse.com/1031254","tags":["report"]},{"url":"https://bugzilla.suse.com/1033109","tags":["report"]},{"url":"https://bugzilla.suse.com/1033111","tags":["report"]},{"url":"https://bugzilla.suse.com/1033112","tags":["report"]},{"url":"https://bugzilla.suse.com/1033113","tags":["report"]},{"url":"https://bugzilla.suse.com/1033120","tags":["report"]},{"url":"https://bugzilla.suse.com/1033126","tags":["report"]},{"url":"https://bugzilla.suse.com/1033127","tags":["report"]},{"url":"https://bugzilla.suse.com/1033129","tags":["report"]},{"url":"https://bugzilla.suse.com/1074317","tags":["report"]},{"url":"https://bugzilla.suse.com/984808","tags":["report"]},{"url":"https://bugzilla.suse.com/984809","tags":["report"]},{"url":"https://bugzilla.suse.com/984831","tags":["report"]},{"url":"https://bugzilla.suse.com/987351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181826-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007276","tags":["report"]},{"url":"https://bugzilla.suse.com/1082332","tags":["report"]},{"url":"https://bugzilla.suse.com/1082825","tags":["report"]},{"url":"https://bugzilla.suse.com/1086408","tags":["report"]},{"url":"https://bugzilla.suse.com/1092949","tags":["report"]},{"url":"https://bugzilla.suse.com/974621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8905","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181889-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18013","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3602-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3606-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-11335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-11613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17095","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7663","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:00:00Z","modified":"2024-08-05T21:06:49.958Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9153","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:00:00Z","modified":"2024-08-05T21:06:49Z","updated_at":"2026-11-03T02:23:08.049216Z"}],"ghsa":[{"id":"GHSA-cp7r-wf78-8x92","title":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory...","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2022-05-14T03:34:33Z","modified":"2023-02-02T05:08:11Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:52:41.430242Z"}],"nvd":[{"id":"CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:29:00.47Z","modified":"2026-06-17T01:12:02.14Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"ALPINE-CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:29:00.47Z","modified":"2026-06-15T18:18:06.788912667Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-18013","title":"CVE-2017-18013 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:34.143301Z","modified":"2026-09-06T07:15:06.923259065Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:29:00.47Z","modified":"2026-10-24T14:03:20.331809582Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T08:29:00.47Z","modified":"2026-09-01T20:03:46.908576914Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-18013","description":"In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.","status":"published","published":"2018-01-01T00:00:00Z","modified":"2026-04-22T11:21:36.562174Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1259-1","title":"tiff - security update","status":"published","published":"2018-01-27T00:00:00Z","modified":"2026-03-09T01:01:33.309114Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1260-1","title":"tiff3 - security update","status":"published","published":"2018-01-27T00:00:00Z","modified":"2026-03-09T01:01:27.792338Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4100-1","title":"tiff - security update","status":"published","published":"2018-01-27T00:00:00Z","modified":"2026-03-09T01:18:46.442181Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0109","title":"Updated libtiff packages fix security vulnerability","description":"tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to\ncause a denial of service (TIFFSetupStrips heap-based buffer overflow and\napplication crash) or possibly have unspecified other impact via a crafted\nTIFF file. (CVE-2017-17095)\n\nIn LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf\nfunction in tools/tiff2pdf.c. This heap overflow could lead to different\ndamages. For example, a crafted TIFF document can lead to an out-of-bounds\nread in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory\ncorruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given\nthese possibilities, it probably could cause arbitrary code execution.\n(CVE-2017-9935)\n\nIn LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c\nTIFFPrintDirectory function, as demonstrated by a tiffinfo crash.\n(CVE-2017-18013)\n","status":"published","published":"2018-02-06T06:25:44Z","modified":"2026-04-16T06:24:45.311681487Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11461-1","title":"libtiff-devel-32bit-4.3.0-1.3 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.3.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:53.504228Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1472-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-5315: The setByteArray function in tif_dir.c allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.  (bsc#984809)\n- CVE-2016-10267: LibTIFF allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8.  (bsc#1017694)\n- CVE-2016-10269: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 512' and libtiff/tif_unix.c:340:2.  (bsc#1031254)\n- CVE-2016-10270: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 8' and libtiff/tif_read.c:523:22.  (bsc#1031250)\n- CVE-2017-18013: In LibTIFF, there was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.  (bsc#1074317)\n- CVE-2017-7593: tif_read.c did not ensure that tif_rawdata is properly initialized, which might have allowed remote attackers to obtain sensitive information from process memory via a crafted image.  (bsc#1033129)\n- CVE-2017-7595: The JPEGSetupEncode function in tiff_jpeg.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.  (bsc#1033127)\n- CVE-2017-7596: LibTIFF had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033126)\n- CVE-2017-7597: tif_dirread.c had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033120)\n- CVE-2017-7599: LibTIFF had an 'outside the range of representable values of type short' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033113)\n- CVE-2017-7600: LibTIFF had an 'outside the range of representable values of type unsigned char' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033112)\n- CVE-2017-7601: LibTIFF had a 'shift exponent too large for 64-bit type long' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033111)\n- CVE-2017-7602: LibTIFF had a signed integer overflow, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033109)\n- Multiple divide by zero issues\n- CVE-2016-5314: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.  (bsc#987351 bsc#984808 bsc#984831)\n","status":"published","published":"2018-05-30T07:08:57Z","modified":"2026-02-04T04:13:28.461355Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1826-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-18013: There was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.  (bsc#1074317)\n- CVE-2018-10963: The TIFFWriteDirectorySec() function in tif_dirwrite.c allowed remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.  (bsc#1092949)\n- CVE-2018-7456: Prevent a NULL Pointer dereference in the function TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013 (bsc#1082825)\n- CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer (bsc#1082332)\n- CVE-2018-8905: Prevent heap-based buffer overflow in the function LZWDecodeCompat via a crafted TIFF file (bsc#1086408)\n- CVE-2016-8331: Prevent remote code execution because of incorrect handling of TIFF images. A crafted TIFF document could have lead to a type confusion vulnerability resulting in remote code execution. This vulnerability could have been be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality (bsc#1007276)\n- CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image (bsc#974621)\n","status":"published","published":"2018-06-27T10:45:25Z","modified":"2026-02-04T03:29:49.152301Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1889-1","title":"Security update for tiff","description":"This update for tiff fixes the following security issues:\n\nThese security issues were fixed:\n\n- CVE-2017-18013: Fixed a NULL pointer dereference in the\n  tif_print.cTIFFPrintDirectory function that could have lead to denial of\n  service (bsc#1074317).\n- CVE-2018-10963: Fixed an assertion failure in the TIFFWriteDirectorySec()\n  function in tif_dirwrite.c, which allowed remote attackers to cause a denial\n  of service via a crafted file (bsc#1092949).\n- CVE-2018-7456: Prevent a NULL Pointer dereference in the function\n  TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF\n  information, a different vulnerability than CVE-2017-18013 (bsc#1082825).\n- CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During\n  the TIFFOpen process, td_imagelength is not checked. The value of\n  td_imagelength can be directly controlled by an input file. In the\n  ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called\n  based on td_imagelength. If the value of td_imagelength is set close to the\n  amount of system memory, it will hang the system or trigger the OOM killer\n  (bsc#1082332).\n- CVE-2018-8905: Prevent heap-based buffer overflow in the function\n  LZWDecodeCompat via a crafted TIFF file (bsc#1086408).\n","status":"published","published":"2018-07-05T06:41:28Z","modified":"2026-02-04T04:40:13.107634Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3602-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image, a remote attacker could crash the application, leading to a\ndenial of service, or possibly execute arbitrary code with user privileges.\n","status":"published","published":"2018-03-20T17:20:33Z","modified":"2026-04-22T09:44:20.268072Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3606-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image, a remote attacker could crash the application, leading to a\ndenial of service, or possibly execute arbitrary code with user privileges.\n","status":"published","published":"2018-03-26T11:50:26Z","modified":"2026-04-22T09:44:35.256754Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}