CVE-2020-18768
Fixed in a distro release EPSS <1%
There exists one heap buffer overflow in _TIFFmemcpy in tif_unix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file.
Products: libtiff
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libtiff | 4.0.3-35.amzn2.0.19 |
| Amazon Linux 2 | libtiff-devel | 4.0.3-35.amzn2.0.19 |
| Amazon Linux 2 | libtiff-static | 4.0.3-35.amzn2.0.19 |
| Amazon Linux 2 | libtiff-tools | 4.0.3-35.amzn2.0.19 |
| Debian 12 | tiff | 4.0.10+git190814-1 |
| Debian 13 | tiff | 4.0.10+git190814-1 |
| Debian 14 | tiff | 4.0.10+git190814-1 |
| Debian 9 | tiff | 4.0.8-2+deb9u7 |
| SUSE Linux Enterprise Micro 5.2 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Micro 5.3 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Micro 5.4 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Micro 5.5 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | tiff | 4.0.9-150000.45.32.1 |
| SUSE Linux Enterprise Server 12 SP5 | tiff | 4.0.9-44.71.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tiff | 4.0.9-44.71.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | tiff | 4.0.9-44.71.1 |
| openSUSE Leap 15.4 | tiff | 4.0.9-150000.45.32.1 |
| openSUSE Leap 15.5 | tiff | 4.0.9-150000.45.32.1 |
| openSUSE Leap Micro 5.3 | tiff | 4.0.9-150000.45.32.1 |
| openSUSE Leap Micro 5.4 | tiff | 4.0.9-150000.45.32.1 |