CVE-2017-5225
Ubuntu Security Notice USN-3212-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.
LibTIFF en la versión 4.0.7 es vulnerable a un desbordamiento de búfer de memoria dinámica en tools/tiffcp resultando en un DoS o ejecución de código a través de un valor BitsPerSample manipulado.
USN-3212-1 fixed several issues in LibTIFF. This update provides a subset of corresponding update for Ubuntu 12.04 ESM. Mei Wang discovered a multiple integer overflows in LibTIFF which allows remote attackers to cause a denial of service or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write. It was discovered that LibTIFF is vulnerable to a heap buffer overflow in the resulting in DoS or code execution via a crafted BitsPerSample value. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-01-09 CVE Reserved
- 2017-01-12 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/95413 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037911 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://bugzilla.maptools.org/show_bug.cgi?id=2656 | 2024-08-05 | |
| http://bugzilla.maptools.org/show_bug.cgi?id=2657 | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7 | 2017-11-04 |
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3844 | 2017-11-04 | |
| https://security.gentoo.org/glsa/201709-27 | 2017-11-04 |