Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2017-5563: LibTIFF 4.0.7 can be crashed or hijacked by BMP file
CVE-2017-5563 · published 9 years ago
Summary
The LibTIFF library version 4.0.7, used in Debian packages tiff and rootio-tiff, can read specially crafted BMP images that cause the program to read beyond its memory buffer. This can lead to the application crashing or, in some cases, allow an attacker to run their own code. Upgrade to a newer LibTIFF version or apply the vendor's security patch to stop the issue.
What to do
- Update debian tiff to version 4.0.7-1.
- Update debian rootio-tiff to version 4.5.0-6+deb12u3.root.io.18.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | tiff |
< 4.0.7-1 Fix: upgrade to 4.0.7-1
|
| Debian:13 | debian | tiff |
< 4.0.7-1 Fix: upgrade to 4.0.7-1
|
| Debian:14 | debian | tiff |
< 4.0.7-1 Fix: upgrade to 4.0.7-1
|
| Root:Debian:12 | debian | rootio-tiff |
< 4.5.0-6+deb12u3.root.io.18 Fix: upgrade to 4.5.0-6+deb12u3.root.io.18
|
| – | libtiff | libtiff |
4.0.7 cpe:2.3:a:libtiff:libtiff:4.0.7:*:*:*:*:*:*:* |
Original advisory text
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
References
- https://security-tracker.debian.org/tracker/CVE-2017-5563 Vendor Advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=2664 Issue Tracking
- http://www.securityfocus.com/bid/95705 Third Party Advisory VDB Entry
- https://security.gentoo.org/glsa/201709-27
- https://usn.ubuntu.com/3606-1/
Severity
8.8
High
Type
CWE-125Out-of-bounds Read
Timeline
Published23 Jan 2017
Updated25 Oct 2026
First seen31 Mar 2026
Track software like this
Free during beta