6.5

CVE-2018-7456

Exploit
A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libtiff ≫ Libtiff Version4.0.9
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.02% 0.858
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://access.redhat.com/errata/RHSA-2019:2053
https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2018/dsa-4349
Third Party Advisory
http://bugzilla.maptools.org/show_bug.cgi?id=2778
Third Party Advisory
Exploit
Issue Tracking
https://access.redhat.com/errata/RHSA-2019:2051
https://github.com/xiaoqx/pocs/tree/master/libtiff
Third Party Advisory
Exploit
https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00010.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/04/msg00011.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/3864-1/
Third Party Advisory