CVE-2018-18557

Source
Severity High
Remote Yes
Type Arbitrary code execution
Description
libtiff up to and including 4.0.9 decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size. The issue occurs because JBIGDecode() entirely ignores the size of the buffer that is passed to it.
Group Package Affected Fixed Severity Status Ticket
AVG-791 lib32-libtiff 4.0.9-1 High Vulnerable FS#60599
AVG-790 libtiff 4.0.9-2 High Vulnerable FS#60599
References
https://bugs.chromium.org/p/project-zero/issues/detail?id=1697
https://gitlab.com/libtiff/libtiff/merge_requests/38
https://gitlab.com/libtiff/libtiff/commit/681748ec2f5ce88da5f9fa6831e1653e46af8a66