1. CVE-Search
  2. CVE-2018-7456
ID CVE-2018-7456
Summary A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
References
Vulnerable Configurations
  • cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 29-01-2021 - 20:15)
Impact:
Exploitability:
CWE CWE-476
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • bugzilla
    id 1556708
    title CVE-2018-7456 libtiff: NULL pointer dereference in tif_print.c:TIFFPrintDirectory() causes a denial of service
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • comment compat-libtiff3 is earlier than 0:3.9.4-12.el7
        oval oval:com.redhat.rhsa:tst:20192051001
      • comment compat-libtiff3 is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20192051002
    rhsa
    id RHSA-2019:2051
    released 2019-08-06
    severity Low
    title RHSA-2019:2051: compat-libtiff3 security update (Low)
  • rhsa
    id RHSA-2019:2053
rpms
  • compat-libtiff3-0:3.9.4-12.el7
  • compat-libtiff3-debuginfo-0:3.9.4-12.el7
  • libtiff-0:4.0.3-32.el7
  • libtiff-debuginfo-0:4.0.3-32.el7
  • libtiff-devel-0:4.0.3-32.el7
  • libtiff-static-0:4.0.3-32.el7
  • libtiff-tools-0:4.0.3-32.el7
refmap via4
confirm https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b
debian DSA-4349
misc
mlist
  • [debian-lts-announce] 20180416 [SECURITY] [DLA 1346-1] tiff security update
  • [debian-lts-announce] 20180416 [SECURITY] [DLA 1347-1] tiff3 security update
  • [debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update
ubuntu USN-3864-1
Last major update 29-01-2021 - 20:15
Published 24-02-2018 - 06:29
Last modified 29-01-2021 - 20:15
Back to Top