{"id":"CVE-2018-5360","details":"LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.","modified":"2026-07-08T16:40:57.274464Z","published":"2018-01-14T02:29:04.667Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"graphicsmagick:graphicsmagick","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.27:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.27"},{"last_affected":"1.3.27"}]}]},"references":[{"type":"REPORT","url":"http://bugzilla.maptools.org/show_bug.cgi?id=2500"},{"type":"REPORT","url":"https://sourceforge.net/p/graphicsmagick/bugs/540/"},{"type":"FIX","url":"https://gitlab.com/libtiff/libtiff/commit/739dcd28a061738b317c1e9f91029d9cbc157159"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vadz/libtiff","events":[{"introduced":"0"},{"fixed":"8a37c8e244de3457283b54986d09a8db4d24381c"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.0.6"}]}}],"versions":["Release-v4-0-5","Release-v4-0-4","Release-v4-0-4beta","Release-v4-0-3","Release-v4-0-2","Release-v4-0-1","Release-v4-0-0","Release-v4-0-0beta7","Release-v4-0-0alpha6","Release-v4-0-0alpha5","Release-v4-0-0alpha4","Release-v4-0-0alpha","Release-v3-8-2","Release-v3-8-1","Release-v3-8-0","Release-v3-7-4","Release-v3-7-3","Release-v3-7-2","Release-v3-7-1","Release-3-7-0","Release-v3-7-0beta2","Release-v3-7-0beta","Release-v3-7-0-alpha","Release-v3-6-1","Release-v3-6-0","Release-v3-6-0beta2","Pre360","Release-v3-5-7","Release-v3-5-5","Release-v3-5-4","Release-v3-5-","Release-"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5360.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/libtiff/libtiff","events":[{"introduced":"0"},{"fixed":"5612707c086cda76319552a0a2afeddcfa67d1b3"},{"fixed":"739dcd28a061738b317c1e9f91029d9cbc157159"}],"database_specific":{"cpe":"cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.0.6"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v4.0.6","v4.0.5","v4.0.4","v4.0.4beta","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v4.0.0beta7","v4.0.0alpha6","v4.0.0alpha5","v4.0.0alpha4","v4.0.0alpha","v3.8.2","v3.8.1","v3.8.0","v3.7.4","v3.7.3","v3.7.2","v3.7.1","v3.7.0","v3.7.0beta2","v3.7.0beta","v3.7.0alpha","v3.6.1","v3.6.0","v3.6.0beta2","v3.5.7","v3.5.5","v3.5.4","v3.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5360.json","vanir_signatures_modified":"2026-07-08T16:40:57Z","vanir_signatures":[{"match_only_versions":["v3.5.3","v3.5.4","v3.5.5","v3.5.7","v3.6.0","v3.6.0beta2","v3.6.1","v3.7.0","v3.7.0alpha","v3.7.0beta","v3.7.0beta2","v3.7.1","v3.7.2","v3.7.3","v3.7.4","v3.8.0","v3.8.1","v3.8.2","v4.0.0","v4.0.0alpha","v4.0.0alpha4","v4.0.0alpha5","v4.0.0alpha6","v4.0.0beta7","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.4beta","v4.0.5","v4.0.6"],"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@739dcd28a061738b317c1e9f91029d9cbc157159","target":{"file":"libtiff/tif_dirwrite.c"},"deprecated":false,"digest":{"line_hashes":["61569868602208278142543250356083065835","171923524337809754821741671617932284290","81378857631154961215226172926732042937","287415081405752620846504667074555205995","110188842041252082907289411813138340834","215857215053830936438829670178056166041"],"threshold":0.9},"id":"CVE-2018-5360-080eea7d"},{"signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@739dcd28a061738b317c1e9f91029d9cbc157159","target":{"file":"libtiff/tif_dir.c"},"deprecated":false,"digest":{"line_hashes":["163556274338990316519011545089318416687","238038622444975051665130753080447867337","61873261279205231678512461018889780688","294275126327564873015573283823558383173","13668015845256240478618664371273870394"],"threshold":0.9},"id":"CVE-2018-5360-274d283f","match_only_versions":["v3.5.3","v3.5.4","v3.5.5","v3.5.7","v3.6.0","v3.6.0beta2","v3.6.1","v3.7.0","v3.7.0alpha","v3.7.0beta","v3.7.0beta2","v3.7.1","v3.7.2","v3.7.3","v3.7.4","v3.8.0","v3.8.1","v3.8.2","v4.0.0","v4.0.0alpha","v4.0.0alpha4","v4.0.0alpha5","v4.0.0alpha6","v4.0.0beta7","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.4beta","v4.0.5","v4.0.6"]},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@739dcd28a061738b317c1e9f91029d9cbc157159","target":{"file":"libtiff/tif_dir.c","function":"_TIFFVSetField"},"deprecated":false,"digest":{"function_hash":"259479423939519279177470380675914412870","length":14427},"id":"CVE-2018-5360-af078396"},{"deprecated":false,"digest":{"function_hash":"175712132688296538464731449866632895834","length":15859},"id":"CVE-2018-5360-e5d9e567","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@739dcd28a061738b317c1e9f91029d9cbc157159","target":{"file":"libtiff/tif_dirwrite.c","function":"TIFFWriteDirectorySec"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}