{"id":"CVE-2017-7595","aliases":["ALPINE-CVE-2017-7595","BELL-CVE-2017-7595","DEBIAN-CVE-2017-7595","DLA-911-1","DLA-912-1","DSA-3844-1","EUVD-2017-16600","GHSA-rmg3-42qr-2vrh","MGASA-2017-0199","SUSE-SU-2017:2569-1","SUSE-SU-2018:1472-1","UBUNTU-CVE-2017-7595","USN-3602-1","openSUSE-SU-2024:11461-1"],"status":"published","title":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a...","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01374,"percentile":0.72183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2017-04-09T00:00:00Z","modified":"2026-10-24T10:30:52Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"tiff","fixed_in":["4.0.7-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.0.7-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.0.7-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.0.7-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tiff","fixed_in":["4.0.3-7ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tiff","fixed_in":["4.0.6-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-6"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-6+deb7u12"}]}],"versions":["4.0.2-6","4.0.2-6+deb7u1","4.0.2-6+deb7u10","4.0.2-6+deb7u11","4.0.2-6+deb7u2","4.0.2-6+deb7u3","4.0.2-6+deb7u4","4.0.2-6+deb7u5","4.0.2-6+deb7u6","4.0.2-6+deb7u7","4.0.2-6+deb7u8","4.0.2-6+deb7u9"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"tiff3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-11+deb7u5"}]}],"versions":["3.9.6-11","3.9.6-11+deb7u1","3.9.6-11+deb7u2","3.9.6-11+deb7u3","3.9.6-11+deb7u4"],"bundled":8},{"source":"osv","ecosystem":"Debian:8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-12.3+deb8u3"}]}],"versions":["4.0.3-12.3","4.0.3-12.3+deb8u1","4.0.3-12.3+deb8u2"],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga5"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-44.3.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.6.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.8"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.3"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.8"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7"],"bundled":27},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.3"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2"],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.3"}]}],"bundled":48}],"products":[{"vendor":"libtiff","product":"libtiff"}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3844","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201709-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://blogs.gentoo.org/ago/2017/04/01/libtiff-divide-by-zero-in-jpegsetupencode-tiff_jpeg-c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3602-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/97501","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7595"},{"url":"https://usn.ubuntu.com/3602-1"},{"url":"https://github.com/advisories/GHSA-rmg3-42qr-2vrh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-7595","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-7595","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7595","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20057","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172569-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1033109","tags":["report"]},{"url":"https://bugzilla.suse.com/1033111","tags":["report"]},{"url":"https://bugzilla.suse.com/1033112","tags":["report"]},{"url":"https://bugzilla.suse.com/1033113","tags":["report"]},{"url":"https://bugzilla.suse.com/1033118","tags":["report"]},{"url":"https://bugzilla.suse.com/1033120","tags":["report"]},{"url":"https://bugzilla.suse.com/1033126","tags":["report"]},{"url":"https://bugzilla.suse.com/1033127","tags":["report"]},{"url":"https://bugzilla.suse.com/1033128","tags":["report"]},{"url":"https://bugzilla.suse.com/1033129","tags":["report"]},{"url":"https://bugzilla.suse.com/1033131","tags":["report"]},{"url":"https://bugzilla.suse.com/1038438","tags":["report"]},{"url":"https://bugzilla.suse.com/1042804","tags":["report"]},{"url":"https://bugzilla.suse.com/1042805","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9404","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017694","tags":["report"]},{"url":"https://bugzilla.suse.com/1031250","tags":["report"]},{"url":"https://bugzilla.suse.com/1031254","tags":["report"]},{"url":"https://bugzilla.suse.com/1074317","tags":["report"]},{"url":"https://bugzilla.suse.com/984808","tags":["report"]},{"url":"https://bugzilla.suse.com/984809","tags":["report"]},{"url":"https://bugzilla.suse.com/984831","tags":["report"]},{"url":"https://bugzilla.suse.com/987351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18013","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7595","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3602-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7592","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-11335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5784","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7663","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:00:00Z","modified":"2024-08-05T16:04:11.964Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-16600","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:00:00Z","modified":"2024-08-05T16:04:11Z","updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-rmg3-42qr-2vrh","title":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a...","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2022-05-14T03:36:18Z","modified":"2025-04-20T03:35:38Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:01:43.480751Z"}],"nvd":[{"id":"CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:59:00.247Z","modified":"2026-06-17T01:24:43.877Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"ALPINE-CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:59:00.247Z","modified":"2026-06-15T18:18:07.038124995Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2017-7595","title":"CVE-2017-7595 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:10.305788Z","modified":"2026-09-06T07:15:03.617423162Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:59:00.247Z","modified":"2026-10-24T10:30:52.145683747Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T14:59:00.247Z","modified":"2026-09-01T20:03:50.217758Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-7595","description":"The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.","status":"published","published":"2017-04-09T00:00:00Z","modified":"2026-04-22T11:31:56.346182Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-911-1","title":"tiff - security update","status":"published","published":"2017-04-24T00:00:00Z","modified":"2026-03-09T02:08:36.935666Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DLA-912-1","title":"tiff3 - security update","status":"published","published":"2017-04-24T00:00:00Z","modified":"2026-03-09T02:08:45.995754Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3844-1","title":"tiff - security update","status":"published","published":"2017-05-03T00:00:00Z","modified":"2026-03-09T01:23:09.72788Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0199","title":"Updated libtiff packages fix security vulnerability","description":"Heap-based buffer overflow in the readContigStripsIntoBuffer function in\ntif_unix.c in LibTIFF 4.0.7 allows remote attackers to have unspecified\nimpact via a crafted image. (CVE-2016-10092)\n\nInteger overflow in tools/tiffcp.c in LibTIFF 4.0.7 allows remote\nattackers to have unspecified impact via a crafted image, which triggers a\nheap-based buffer overflow.  (CVE-2016-10093)\n\nOff-by-one error in the t2p_readwrite_pdf_image_tile function in\ntools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have\nunspecified impact via a crafted image. (CVE-2016-10094)\n\nStack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service (crash)\nvia a crafted TIFF file. (CVE-2016-10095)\n\nLibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the\ntools/tiffcp resulting in DoS or code execution via a crafted\nBitsPerSample value. (CVE-2017-5225)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(divide-by-zero error and application crash) via a crafted TIFF image,\nrelated to libtiff/tif_read.c:351:22. (CVE-2016-10266)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(divide-by-zero error and application crash) via a crafted TIFF image,\nrelated to libtiff/tif_ojpeg.c:816:8. (CVE-2016-10267)\n\ntools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial\nof service (integer underflow and heap-based buffer under-read) or\npossibly have unspecified other impact via a crafted TIFF image, related\nto \"READ of size 78490\" and libtiff/tif_unix.c:115:23. (CVE-2016-10268)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer over-read) or possibly have unspecified other impact\nvia a crafted TIFF image, related to \"READ of size 512\" and\nlibtiff/tif_unix.c:340:2. (CVE-2016-10269)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer over-read) or possibly have unspecified other impact\nvia a crafted TIFF image, related to \"READ of size 8\" and\nlibtiff/tif_read.c:523:22. (CVE-2016-10270)\n\ntools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a\ndenial of service (heap-based buffer over-read and buffer overflow) or\npossibly have unspecified other impact via a crafted TIFF image, related\nto \"READ of size 1\" and libtiff/tif_fax3.c:413:13. (CVE-2016-10271)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer overflow) or possibly have unspecified other impact via\na crafted TIFF image, related to \"WRITE of size 2048\" and\nlibtiff/tif_next.c:64:9. (CVE-2016-10272)\n\nThe putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a\nleft-shift undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7592)\n\ntif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly\ninitialized, which might allow remote attackers to obtain sensitive\ninformation from process memory via a crafted image. (CVE-2017-7593)\n\nThe OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF\n4.0.7 allows remote attackers to cause a denial of service (memory leak)\nvia a crafted image. (CVE-2017-7594)\n\nThe JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote\nattackers to cause a denial of service (divide-by-zero error and\napplication crash) via a crafted image. (CVE-2017-7595)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nfloat\" undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7596)\n\ntif_dirread.c in LibTIFF 4.0.7 has an \"outside the range of representable\nvalues of type float\" undefined behavior issue, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7597)\n\ntif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a\ndenial of service (divide-by-zero error and application crash) via a\ncrafted image. (CVE-2017-7598)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nshort\" undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7599)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nunsigned char\" undefined behavior issue, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7600)\n\nLibTIFF 4.0.7 has a \"shift exponent too large for 64-bit type long\"\nundefined behavior issue, which might allow remote attackers to cause a\ndenial of service (application crash) or possibly have unspecified other\nimpact via a crafted image. (CVE-2017-7601)\n\nLibTIFF 4.0.7 has a signed integer overflow, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7602)\n\nThe TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the\ntiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause\na denial of service (out-of-bounds read) via vectors involving the ma\nvariable. (CVE-2016-3658)\n\ntif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can\nlead to assertion failures in debug mode, or buffer overflows in release\nmode, when dealing with unusual tile size like YCbCr with subsampling.\nReported as MSVR 35105, aka \"Predictor heap-buffer-overflow.\"\n(CVE-2016-9535)\n\nlibtiff: out-of-bounds write in multiple tools. (CVE-2014-8128)\n","status":"published","published":"2017-07-01T07:04:05Z","modified":"2026-04-16T06:26:29.012085607Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11461-1","title":"libtiff-devel-32bit-4.3.0-1.3 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.3.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:53.504228Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:2569-1","title":"Security update for tiff","description":"This update for tiff to version 4.0.8 fixes a several bugs and security issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7595: The JPEGSetupEncode function allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image (bsc#1033127).\n- CVE-2016-10371: The TIFFWriteDirectoryTagCheckedRational function allowed remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file (bsc#1038438).\n- CVE-2017-7598: Error in tif_dirread.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image (bsc#1033118).\n- CVE-2017-7596: Undefined behavior because of floats outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033126).\n- CVE-2017-7597: Undefined behavior because of floats outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033120).\n- CVE-2017-7599: Undefined behavior because of shorts outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033113).\n- CVE-2017-7600: Undefined behavior because of chars outside their expected value range, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033112).\n- CVE-2017-7601: Because of a shift exponent too large for 64-bit type long undefined behavior was caused, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033111).\n- CVE-2017-7602: Prevent signed integer overflow, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033109).\n- CVE-2017-7592: The putagreytile function had a left-shift undefined behavior issue, which might allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033131).\n- CVE-2017-7593: Ensure that tif_rawdata is properly initialized, to prevent remote attackers to obtain sensitive information from process memory via a crafted image (bsc#1033129).\n- CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable function allowed remote attackers to cause a denial of service (memory leak) via a crafted image (bsc#1033128).\n- CVE-2017-9403: Prevent memory leak in function TIFFReadDirEntryLong8Array, which allowed attackers to cause a denial of service via a crafted file (bsc#1042805).\n- CVE-2017-9404: Fixed memory leak vulnerability in function OJPEGReadHeaderInfoSecTablesQTable, which allowed attackers to cause a denial of service via a crafted file (bsc#1042804).\n\nThese various other issues were fixed:\n\n- Fix uint32 overflow in TIFFReadEncodedStrip() that caused an\n  integer division by zero. Reported by Agostino Sarubbo.\n- fix heap-based buffer overflow on generation of PixarLog / LUV\n  compressed files, with ColorMap, TransferFunction attached and\n  nasty plays with bitspersample. The fix for LUV has not been\n  tested, but suffers from the same kind of issue of PixarLog.\n- modify ChopUpSingleUncompressedStrip() to instanciate compute\n  ntrips as TIFFhowmany_32(td-\u003etd_imagelength, rowsperstrip),\n  instead of a logic based on the total size of data. Which is\n  faulty is the total size of data is not sufficient to fill the\n  whole image, and thus results in reading outside of the\n  StripByCounts/StripOffsets arrays when using\n  TIFFReadScanline()\n- make OJPEGDecode() early exit in case of failure in\n  OJPEGPreDecode(). This will avoid a divide by zero, and\n  potential other issues.\n- fix misleading indentation as warned by GCC.\n- revert change done on 2016-01-09 that made Param member of\n  TIFFFaxTabEnt structure a uint16 to reduce size of the\n  binary. It happens that the Hylafax software uses the tables\n  that follow this typedef (TIFFFaxMainTable, TIFFFaxWhiteTable,\n  TIFFFaxBlackTable), although they are not in a public libtiff\n  header.\n- add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants\n  of the functions without ext, with an extra argument to control\n  the stop_on_error behaviour.\n- fix potential memory leaks in error code path of\n  TIFFRGBAImageBegin().\n- increase libjpeg max memory usable to 10 MB instead of libjpeg\n  1MB default. This helps when creating files with 'big' tile,\n  without using libjpeg temporary files.\n- add _TIFFcalloc()\n- return 0 in Encode functions instead of -1 when\n  TIFFFlushData1() fails.\n- only run JPEGFixupTagsSubsampling() if the YCbCrSubsampling\n  tag is not explicitly present. This helps a bit to reduce the\n  I/O amount when the tag is present (especially on cloud hosted\n  files).\n- in LZWPostEncode(), increase, if necessary, the code bit-width\n  after flushing the remaining code and before emitting the EOI\n  code.\n- fix memory leak in error code path of PixarLogSetupDecode().\n- fix potential memory leak in\n  OJPEGReadHeaderInfoSecTablesQTable,\n  OJPEGReadHeaderInfoSecTablesDcTable and\n  OJPEGReadHeaderInfoSecTablesAcTable\n- avoid crash in Fax3Close() on empty file.\n- TIFFFillStrip(): add limitation to the number of bytes read\n  in case td_stripbytecount[strip] is bigger than reasonable,\n  so as to avoid excessive memory allocation.\n- fix memory leak when the underlying codec (ZIP, PixarLog)\n  succeeds its setupdecode() method, but PredictorSetup fails.\n- TIFFFillStrip() and TIFFFillTile(): avoid excessive memory\n  allocation in case of shorten files. Only effective on 64 bit\n  builds and non-mapped cases.\n- TIFFFillStripPartial() / TIFFSeek(), avoid potential integer\n  overflows with read_ahead in CHUNKY_STRIP_READ_SUPPORT mode.\n- avoid excessive memory allocation in case of shorten files.\n  Only effective on 64 bit builds.\n- update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with\n  tif_rawdataloaded when calling TIFFStartStrip() or\n  TIFFFillStripPartial(). \n- avoid potential int32 overflow in TIFFYCbCrToRGBInit() Fixes\n- avoid potential int32 overflows in multiply_ms() and add_ms().\n- fix out-of-buffer read in PackBitsDecode() Fixes\n- LogL16InitState(): avoid excessive memory allocation when\n  RowsPerStrip tag is missing.\n- update dec_bitsleft at beginning of LZWDecode(), and update\n  tif_rawcc at end of LZWDecode(). This is needed to properly\n  work with the latest chnges in tif_read.c in\n  CHUNKY_STRIP_READ_SUPPORT mode.\n- PixarLogDecode(): resync tif_rawcp with next_in and tif_rawcc\n  with avail_in at beginning and end of function, similarly to\n  what is done in LZWDecode(). Likely needed so that it works\n  properly with latest chnges in tif_read.c in\n  CHUNKY_STRIP_READ_SUPPORT mode.\n- initYCbCrConversion(): add basic validation of luma and\n  refBlackWhite coefficients (just check they are not NaN for\n  now), to avoid potential float to int overflows.\n- _TIFFVSetField(): fix outside range cast of double to float.\n- initYCbCrConversion(): check luma[1] is not zero to avoid division by zero\n- _TIFFVSetField(): fix outside range cast of double to float.\n- initYCbCrConversion(): check luma[1] is not zero to avoid\n  division by zero.\n- initYCbCrConversion(): stricter validation for refBlackWhite\n  coefficients values.\n- avoid uint32 underflow in cpDecodedStrips that can cause\n  various issues, such as buffer overflows in the library.\n- fix readContigStripsIntoBuffer() in -i (ignore) mode so that\n  the output buffer is correctly incremented to avoid write\n  outside bounds.\n- add 3 extra bytes at end of strip buffer in\n  readSeparateStripsIntoBuffer() to avoid read outside of heap\n  allocated buffer.\n- fix integer division by zero when BitsPerSample is missing.\n- fix null pointer dereference in -r mode when the image has no\n  StripByteCount tag.\n- avoid potential division by zero is BitsPerSamples tag is\n  missing.\n- when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called, limit\n  the return number of inks to SamplesPerPixel, so that code\n  that parses ink names doesn't go past the end of the buffer.\n- avoid potential division by zero is BitsPerSamples tag is\n  missing.\n- fix uint32 underflow/overflow that can cause heap-based buffer\n  overflow.\n- replace assert( (bps % 8) == 0 ) by a non assert check.\n- fix 2 heap-based buffer overflows (in PSDataBW and\n  PSDataColorContig).\n- prevent heap-based buffer overflow in -j mode on a paletted\n  image.\n- fix wrong usage of memcpy() that can trigger unspecified behaviour.\n- avoid potential invalid memory read in t2p_writeproc.\n- avoid potential heap-based overflow in t2p_readwrite_pdf_image_tile().\n- remove extraneous TIFFClose() in error code path, that caused\n  double free.\n- error out cleanly in cpContig2SeparateByRow and\n  cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap\n  based overflow.\n- avoid integer division by zero.\n- call TIFFClose() in error code paths.\n- emit appropriate message if the input file is empty.\n- close TIFF handle in error code path.\n","status":"published","published":"2017-09-26T07:59:13Z","modified":"2026-02-04T04:26:02.229631Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:1472-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-5315: The setByteArray function in tif_dir.c allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.  (bsc#984809)\n- CVE-2016-10267: LibTIFF allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8.  (bsc#1017694)\n- CVE-2016-10269: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 512' and libtiff/tif_unix.c:340:2.  (bsc#1031254)\n- CVE-2016-10270: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 8' and libtiff/tif_read.c:523:22.  (bsc#1031250)\n- CVE-2017-18013: In LibTIFF, there was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.  (bsc#1074317)\n- CVE-2017-7593: tif_read.c did not ensure that tif_rawdata is properly initialized, which might have allowed remote attackers to obtain sensitive information from process memory via a crafted image.  (bsc#1033129)\n- CVE-2017-7595: The JPEGSetupEncode function in tiff_jpeg.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.  (bsc#1033127)\n- CVE-2017-7596: LibTIFF had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033126)\n- CVE-2017-7597: tif_dirread.c had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033120)\n- CVE-2017-7599: LibTIFF had an 'outside the range of representable values of type short' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033113)\n- CVE-2017-7600: LibTIFF had an 'outside the range of representable values of type unsigned char' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033112)\n- CVE-2017-7601: LibTIFF had a 'shift exponent too large for 64-bit type long' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033111)\n- CVE-2017-7602: LibTIFF had a signed integer overflow, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.  (bsc#1033109)\n- Multiple divide by zero issues\n- CVE-2016-5314: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.  (bsc#987351 bsc#984808 bsc#984831)\n","status":"published","published":"2018-05-30T07:08:57Z","modified":"2026-02-04T04:13:28.461355Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3602-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image, a remote attacker could crash the application, leading to a\ndenial of service, or possibly execute arbitrary code with user privileges.\n","status":"published","published":"2018-03-20T17:20:33Z","modified":"2026-04-22T09:44:20.268072Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}