Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-9147 — Out-of-bounds Read in Tiff

CWE-125 — Out-of-bounds Read17 documents9 sources
Severity
6.5MEDIUMNVD
EPSS
3.8%
top 11.91%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Debian TiffLibtiff
Timeline
PublishedMay 22
Latest updateMay 14

Description

LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDlibtiff/libtiff4.0.7
▶debiandebian/tiff< tiff 4.0.8-2 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-xphx-pcmh-58pq: LibTIFF 4↗2022-05-14
▶
OSV
CVE-2017-9147: LibTIFF 4↗2017-05-22
▶

💥Exploits & PoCs

1
Exploit-DB
LibTIFF - '_TIFFVGetField (tiffsplit)' Out-of-Bounds Read↗2017-07-06
▶

📋Vendor Advisories

3
Ubuntu
LibTIFF vulnerabilities↗2018-03-26
▶
Red Hat
libtiff: Out of bounds read in _TIFFVGetField↗2017-05-12
▶
Debian
CVE-2017-9147: tiff - LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, w...↗2017
▶

🕵️Threat Intelligence

1
Fortinet
The Analysis of ISC BIND NSEC Record Handling DoS (CVE-2016-9147)↗2017-01-25
▶

💬Community

9
Bugzilla
CVE-2017-9147 libtiff: Out of bounds read in _TIFFVGetField↗2017-05-23
▶
Bugzilla
CVE-2017-9147 libtiff: Out of bounds read in _TIFFVGetField [fedora-all]↗2017-05-23
▶
Bugzilla
CVE-2017-9147 mingw-libtiff: libtiff: Out of bounds read in _TIFFVGetField [fedora-all]↗2017-05-23
▶
Bugzilla
CVE-2017-9147 opencv: libtiff: Out of bounds read in _TIFFVGetField [fedora-all]↗2017-05-23
▶
Bugzilla
CVE-2017-9147 mingw-libtiff: libtiff: Out of bounds read in _TIFFVGetField [epel-7]↗2017-05-23
▶