This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2018-12900 →
DEBIAN-CVE-2018-12900
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4,...
Original description
The description as published by the source.
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
tiff
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-4"}]}]
Debian:13
tiff
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-4"}]}]
Debian:14
tiff
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-4"}]}]
References
- advisory security-tracker.debian.org