CVE-2017-17973
Fixed in a distro release EPSS 3%CVSS 8.8
In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue
Products: libtiff
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Desktop 12 SP3 | tiff | 4.0.9-44.10.1 |
| SUSE Linux Enterprise Server 11 SP4 | tiff | 3.8.2-141.169.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | tiff | 4.0.9-44.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | tiff | 3.8.2-141.169.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | tiff | 4.0.9-44.10.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | tiff | 3.8.2-141.169.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | tiff | 4.0.9-44.10.1 |
| Ubuntu Pro 14.04 LTS | tiff | no fix |
| Ubuntu Pro 16.04 LTS | tiff | no fix |
| Ubuntu Pro 18.04 LTS | tiff | no fix |