Debian Security Advisory

DLA-2009-1 tiff -- LTS security update

Date Reported:
26 Nov 2019
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2017-17095, CVE-2018-12900, CVE-2018-18661, CVE-2019-6128, CVE-2019-17546, CVE-2017-17095.
More information:

Several issues have been found in tiff, a Tag Image File Format library.

  • CVE-2019-17546

    The RGBA interface contains an integer overflow that might lead to heap buffer overflow write.

  • CVE-2019-6128

    A memory leak exists due to missing cleanup code.

  • CVE-2018-18661

    In case of exhausted memory there is a null pointer dereference in tiff2bw.

  • CVE-2018-12900

    Fix for heap-based buffer overflow, that could be used to crash an application or even to execute arbitrary code (with the permission of the user running this application).


    A crafted tiff file could lead to a heap buffer overflow in pal2rgb.

    For Debian 8 Jessie, these problems have been fixed in version 4.0.3-12.3+deb8u10.

    We recommend that you upgrade your tiff packages.

    Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: