DEBIAN-CVE-2017-9935

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2017-9935
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2017-9935.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2017-9935
Upstream
Published
2017-06-26T12:29:00.187Z
Modified
2025-11-14T03:03:57.115613Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2pfree, memory corruption in t2preadwritepdfimage, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution.

References

Affected packages

Debian:11 / tiff

Package

Name
tiff
Purl
pkg:deb/debian/tiff?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.9-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / tiff

Package

Name
tiff
Purl
pkg:deb/debian/tiff?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.9-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / tiff

Package

Name
tiff
Purl
pkg:deb/debian/tiff?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.9-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / tiff

Package

Name
tiff
Purl
pkg:deb/debian/tiff?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.9-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}