CVE-2017-5563

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
libtifflibtiff
4.0.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tiff
bookworm
unimportant
bookworm (security)
unimportant
bullseye
unimportant
bullseye (security)
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tiff
artful
not-affected
precise
ignored
trusty
Fixed 4.0.3-7ubuntu0.9
released
xenial
Fixed 4.0.6-1ubuntu0.4
released
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://bugzilla.maptools.org/show_bug.cgi?id=2664
http://www.securityfocus.com/bid/95705
https://security.gentoo.org/glsa/201709-27
https://usn.ubuntu.com/3606-1/
http://bugzilla.maptools.org/show_bug.cgi?id=2664
http://www.securityfocus.com/bid/95705
https://security.gentoo.org/glsa/201709-27
https://usn.ubuntu.com/3606-1/