NVD Vulnerability Detail

CVE-2017-5849

Summary	tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
Publication Date	March 16, 2017, 4:59 a.m.
Registration Date	Jan. 26, 2021, 1:26 p.m.
Last Update	Nov. 21, 2024, 12:28 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:netpbm_project:netpbm:10.47.63:::::::*

Related information, measures and tools

No	URL	タグ
1	http://bugzilla.maptools.org/show_bug.cgi?id=2654	Exploit Issue Tracking Third Party Advisory VDB Entry
2	http://bugzilla.maptools.org/show_bug.cgi?id=2654	Exploit Issue Tracking Third Party Advisory VDB Entry
3	http://bugzilla.maptools.org/show_bug.cgi?id=2655	Exploit Issue Tracking Third Party Advisory VDB Entry
4	http://bugzilla.maptools.org/show_bug.cgi?id=2655	Exploit Issue Tracking Third Party Advisory VDB Entry
5	http://www.openwall.com/lists/oss-security/2017/02/02/2	Mailing List Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2017/02/02/2	Mailing List Third Party Advisory
7	http://www.securityfocus.com/bid/96011
8	http://www.securityfocus.com/bid/96011
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AF42A624FXVY3BYBHMAO6F2X7EJYHQE2/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AF42A624FXVY3BYBHMAO6F2X7EJYHQE2/
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDK3BDMKIQL2NQ3SJZXPBEN2LSOUSSEE/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDK3BDMKIQL2NQ3SJZXPBEN2LSOUSSEE/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html
2	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

netpbm の tiffttopnm におけるサービス運用妨害 (DoS) の脆弱性

Title	netpbm の tiffttopnm におけるサービス運用妨害 (DoS) の脆弱性
Summary	netpbm の tiffttopnm は、libtiff の TIFFRGBAImageGet 関数を適切に使用しないため、サービス運用妨害 (境界外読み取りおよび書き込み) 状態にされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、巧妙に細工された tiff 画像ファイルを介して、サービス運用妨害 (境界外読み取りおよび書き込み) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 5, 2017, midnight
Registration Date	April 11, 2017, 4:27 p.m.
Last Update	April 11, 2017, 4:27 p.m.

Affected System

Fedora Project

Fedora 24

Fedora 25

Netpbm

Netpbm 10.47.63

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-5849	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5849
National Vulnerability Database (NVD)
2	CVE-2017-5849	https://nvd.nist.gov/vuln/detail/CVE-2017-5849

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html
2	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 2654	http://bugzilla.maptools.org/show_bug.cgi?id=2654
2	Bug 2655	http://bugzilla.maptools.org/show_bug.cgi?id=2655
Fedora Update Notification
3	FEDORA-2017-1855c8af2c	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDK3BDMKIQL2NQ3SJZXPBEN2LSOUSSEE/
4	FEDORA-2017-fa4e441e03	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AF42A624FXVY3BYBHMAO6F2X7EJYHQE2/
Netpbm
5	Top Page	http://netpbm.sourceforge.net/

Change Log

No	Changed Details	Date of change
0	[2017年04月11日] 掲載	Feb. 17, 2018, 10:37 a.m.