Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2017-7593: LibTIFF may leak data through crafted image
CVE-2017-7593 · published 9 years ago
Summary
The LibTIFF library version 4.0.7 can expose information it is using when it reads a specially formed TIFF picture. An attacker who supplies such an image could read that data. Upgrade LibTIFF to a newer version or apply the available security patch, and avoid opening untrusted images.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| libtiff | libtiff |
4.0.7 cpe:2.3:a:libtiff:libtiff:4.0.7:*:*:*:*:*:*:* |
Original advisory text
CVE-2017-7593 does not affect BellSoft software
tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.
References
- https://docs.bell-sw.com/security/cves/CVE-2017-7593 Vendor Advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=2651 Issue Tracking
- http://www.debian.org/security/2017/dsa-3844
- http://www.securityfocus.com/bid/97502 Third Party Advisory VDB Entry
- https://security.gentoo.org/glsa/201709-27
- https://usn.ubuntu.com/3602-1/
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published9 Apr 2017
Updated4 Nov 2026
First seen6 Sep 2026
Track software like this
Free during beta