Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported.
NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.
Package Name: media-libs/tiff
Package Version: [cpe:/a:libtiff:libtiff:4.0.6 cpe:/a:libtiff:libtiff:4.0.7 cpe:/a:libtiff_project:libtiff:4.0.6 cpe:/a:libtiff_project:libtiff:4.0.7]
Advisory: CVE-2017-9117
Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2017-9117
CVSS severity score: 7.5/10.0
Confidence: high
Description:
In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.
Advisory: CVE-2017-9147
Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2017-9147
CVSS severity score: 4.3/10.0
Confidence: high
Description:
LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.
Comment 1 by kenrb@chromium.org
, May 25 2017Components: Internals>Plugins>PDF
Labels: M-60 Security_Severity-Medium Security_Impact-Stable
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)