CVE-2017-11613

In LibTIFF 4.0.8, there is a denial of service vulnerability in the
TIFFOpen function. A crafted input will lead to a denial of service attack.
During the TIFFOpen process, td_imagelength is not checked. The value of
td_imagelength can be directly controlled by an input file. In the
ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is
called based on td_imagelength. If we set the value of td_imagelength close
to the amount of system memory, it will hang the system or trigger the OOM
killer.

Bugs

• <http://bugzilla.maptools.org/show_bug.cgi?id=2724&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=1475530&gt;
• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869823&gt;

Notes