// For flags

CVE-2017-17095

LibTIFF pal2rgb 4.0.9 - Heap Buffer Overflow

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file.

tools/pal2rgb.c en pal2rgb en LibTIFF 4.0.7 permite que atacantes remotos provoquen una denegación de servicio (desbordamiento de búfer basado en memoria dinámica o heap de TIFFSetupStrips y cierre inesperado de la aplicación) o, probablemente, causen otros impactos no especificados mediante un archivo TIFF manipulado.

LibTIFF pal2rgb version 4.0.9 suffers from a heap buffer overflow.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-12-02 CVE Reserved
  • 2017-12-02 CVE Published
  • 2023-04-25 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Libtiff
Search vendor "Libtiff"
 Libtiff
Search vendor "Libtiff" for product "Libtiff"
 4.0.9
Search vendor "Libtiff" for product "Libtiff" and version "4.0.9"
-
Affected