CVE-2018-12900

Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "14.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "introduced": "16.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "introduced": "18.04"
                },
                {
                    "last_affected": "18.04"
                },
                {
                    "introduced": "18.10"
                },
                {
                    "last_affected": "18.10"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "canonical:ubuntu_linux",
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git / github.com/vadz/libtiff

Affected ranges

Type

GIT

Repo

https://github.com/vadz/libtiff

Events

Introduced

636f2684a0faaf9510ae4219f286a53f98f37483

Last affected

636f2684a0faaf9510ae4219f286a53f98f37483

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.0.9"
        },
        {
            "last_affected": "4.0.9"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*"
}

Affected versions

4.*

4.0.9

Other

Release-v4-0-9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12900.json"

Git / gitlab.com/libtiff/libtiff

Affected ranges

Type

GIT

Repo

https://gitlab.com/libtiff/libtiff

Events

Introduced

020bd2fd3b4235b2175dafa9633d2b191c50e7cd

Last affected

020bd2fd3b4235b2175dafa9633d2b191c50e7cd

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.0.9"
        },
        {
            "last_affected": "4.0.9"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*"
}

Affected versions

4.*

4.0.9

v4.*

v4.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12900.json"