CVE-2014-8127

描述

LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.

如何修補 CVE-2014-8127

要修補 CVE-2014-8127,請將受影響套件升級到下列已修補版本。

• —升級至 4.0.7-r0 或更新版本
• —升級至 4.0.6-3 或更新版本
• —升級至 4.0.2-6+deb7u4 或更新版本

CVE-2014-8127 正在被利用嗎?

中等 — EPSS 為 5.7%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 4.0.7-r0
• from 0, < 4.0.6-3
• from 0, < 4.0.2-6+deb7u4

CVSS 分數

參考連結(2)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-8127
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2014-8127