| Name | CVE-2018-7456 |
| Description | A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1346-1, DLA-1347-1, DLA-1411-1, DSA-4349-1 |
| Debian Bugs | 891288 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| tiff (PTS) | jessie, jessie (lts) | 4.0.3-12.3+deb8u17 | fixed |
| stretch (security) | 4.0.8-2+deb9u8 | fixed | |
| stretch (lts), stretch | 4.0.8-2+deb9u12 | fixed | |
| buster (security), buster, buster (lts) | 4.1.0+git191117-2~deb10u9 | fixed | |
| bullseye (security), bullseye | 4.2.0-1+deb11u5 | fixed | |
| bookworm (security), bookworm | 4.5.0-6+deb12u1 | fixed | |
| sid, trixie | 4.5.1+git230720-5 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| tiff | source | wheezy | 4.0.2-6+deb7u19 | DLA-1346-1 | ||
| tiff | source | jessie | 4.0.3-12.3+deb8u6 | DLA-1411-1 | ||
| tiff | source | stretch | 4.0.8-2+deb9u4 | DSA-4349-1 | ||
| tiff | source | (unstable) | 4.0.9-5 | 891288 | ||
| tiff3 | source | wheezy | 3.9.6-11+deb7u10 | DLA-1347-1 | ||
| tiff3 | source | (unstable) | (unfixed) |
http://bugzilla.maptools.org/show_bug.cgi?id=2778
https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b