Description
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://usn.ubuntu.com/3606-1/ ↗
- https://usn.ubuntu.com/3602-1/ ↗
- https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html ↗
- https://www.debian.org/security/2018/dsa-4349 ↗
- http://bugzilla.maptools.org/show_bug.cgi?id=2772 ↗
- https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html ↗
- https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef ↗