CVE-2017-16232

Published: Mar 21, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue

Affected (10)

Products: Libtiff: Libtiff · Opensuse: Leap · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Version 4.0.8

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.2
Opensuse Leap	Version 42.3

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Desktop	Version 12 sp2
Suse Linux Enterprise Desktop	Version 12 sp3
Suse Linux Enterprise Server	Version 12 sp2
Suse Linux Enterprise Server	Version 12 sp2
Suse Linux Enterprise Server	Version 12 sp3
Suse Linux Enterprise Software Development Kit	Version 12 sp2
Suse Linux Enterprise Software Development Kit	Version 12 sp3

Related CWEs

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (20)

http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html

Source: cve@mitre.org

Third Party Advisory

http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Dec/32

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://seclists.org/fulldisclosure/2018/Dec/47

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/11

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/7

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/101696

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Dec/32

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://seclists.org/fulldisclosure/2018/Dec/47

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/11/01/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/101696

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.