A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tiff | Aug 22, 2024 | Feb 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade libtiff-staticUpgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff-debuginfoUpgrade compat-libtiff3-debuginfoUpgrade compat-libtiff3Upgrade libtiff | Apr 27, 2020 | Feb 24, 2018 |
| Amazon_linux | — | Upgrade libtiff | Oct 11, 2019 | Feb 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 24, 2018 |
| Centos_linux | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-debuginfoUpgrade compat-libtiff3-debuginfoUpgrade libtiff-staticUpgrade compat-libtiff3Upgrade libtiff | Aug 28, 2019 | Feb 24, 2018 |
| Debian | — | Upgrade tiff3Upgrade tiff | Dec 2, 2018 | Feb 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libtiff-develUpgrade libtiff | Nov 3, 2020 | Feb 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libtiffUpgrade libtiff-devel | Nov 19, 2019 | Feb 24, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libtiff-develUpgrade libtiff | Nov 19, 2019 | Feb 24, 2018 |
| Oracle Solaris | — | Upgrade image/library/libtiff to version 4.0.10-11.4.6.0.1.1.0 on Solaris 11.4Upgrade x11/library/toolkit/fltk to version 1.3.4-11.4.6.0.1.1.0 on Solaris 11.4Upgrade x11/server/xvnc to version 1.7.1-11.4.6.0.1.1.0 on Solaris 11.4Upgrade desktop/remote-desktop/tigervnc to version 1.7.1-11.4.6.0.1.1.0 on Solaris 11.4Upgrade library/gd to version 2.2.5-11.4.6.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/gdm to version 3.24.2-11.4.6.0.1.1.0 on Solaris 11.4Upgrade library/glib2 to version 2.52.0-11.4.6.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Feb 24, 2018 |
| Oracle_linux | — | Upgrade libtiffUpgrade libtiff-toolsUpgrade compat-libtiff3Upgrade libtiff-staticUpgrade libtiff-devel | Jul 21, 2020 | Feb 24, 2018 |
| Redhat_linux | — | No solution existsUpgrade libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiffUpgrade libtiff-toolsUpgrade compat-libtiff3Upgrade libtiff-develUpgrade compat-libtiff3-debuginfo | Aug 7, 2019 | Feb 24, 2018 |
| Suse | — | Upgrade libtiff-devel-32bitUpgrade libtiff-develUpgrade libtiff5-32bitUpgrade libtiff3Upgrade tiffUpgrade libtiff3-x86Upgrade libtiff5Upgrade libtiff3-32bit | Jun 28, 2018 | Feb 24, 2018 |
| Ubuntu | — | Upgrade libtiff5Upgrade libtiff-tools | Jan 31, 2019 | Feb 24, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub