Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2018-8905 Details

Description

In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://bugzilla.maptools.org/show_bug.cgi?id=2780 CVEExploitIssue TrackingThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:2053 CVEThird Party Advisory
https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow CVEExploitThird Party Advisory
https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d CVEPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/05/msg00008.html CVEMailing ListThird Party Advisory

see all 18 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-787Out-of-bounds Write[email protected]

Affected Products

ProductVersions

Change History

14 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2018-8905
NVD Published Date:
Mar 22, 2018
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2018-8905 Details - Not Deferred