{"id":"CVE-2018-5784","details":"In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.","modified":"2026-07-08T19:45:47.787417Z","published":"2018-01-19T08:29:00.320Z","related":["SUSE-SU-2018:1180-1","openSUSE-SU-2024:11461-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"17.10"},{"last_affected":"17.10"}]},{"vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3602-1/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3606-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4349"},{"type":"REPORT","url":"http://bugzilla.maptools.org/show_bug.cgi?id=2772"},{"type":"FIX","url":"https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vadz/libtiff","events":[{"introduced":"636f2684a0faaf9510ae4219f286a53f98f37483"},{"last_affected":"636f2684a0faaf9510ae4219f286a53f98f37483"}],"database_specific":{"cpe":"cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0.9"},{"last_affected":"4.0.9"}],"source":"CPE_STRING"}}],"versions":["4.0.9","Release-v4-0-9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5784.json"}},{"ranges":[{"type":"GIT","repo":"https://gitlab.com/libtiff/libtiff","events":[{"introduced":"020bd2fd3b4235b2175dafa9633d2b191c50e7cd"},{"last_affected":"020bd2fd3b4235b2175dafa9633d2b191c50e7cd"},{"fixed":"473851d211cf8805a161820337ca74cc9615d6ef"}],"database_specific":{"cpe":"cpe:2.3:a:libtiff:libtiff:4.0.9:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0.9"},{"last_affected":"4.0.9"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.0.9","v4.0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5784.json","vanir_signatures_modified":"2026-07-08T19:45:47Z","vanir_signatures":[{"digest":{"line_hashes":["75831772826903519163531091244361149601","78375691951534252794824230083328114641","293301950844137652162995674059519515684","199221968750314404018989121865056121067","5327546639558208921209613398130438931","131256751223841078268448253529362595545","330585039822195982558293263417307448225"],"threshold":0.9},"id":"CVE-2018-5784-32fcc861","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef","target":{"file":"tools/tiff2pdf.c"},"deprecated":false},{"target":{"file":"tools/tiff2pdf.c","function":"t2p_read_tiff_init"},"deprecated":false,"digest":{"function_hash":"213609115515777586211141951442237006584","length":5724},"id":"CVE-2018-5784-4a632204","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef"},{"digest":{"function_hash":"217941978878947320029816834975166642295","length":1584},"id":"CVE-2018-5784-6a8edbef","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef","target":{"function":"TIFF_WriteOverview","file":"contrib/addtiffo/tif_overview.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["280118026582751531607203991365373546876","43719099175510905525229923302533711661","70680763122485257495134726048061920842","57881666676319679057535677400894311885","106582711542385200867802239147585812831","132354293960869030127950657134287496699","55761791276588461682510708734136367267","337647114143564325189136562211559769739","223325157716770488910409838864759636822","42083156524159150658991999267604601331","204171970194303696611234922170369988794"],"threshold":0.9},"id":"CVE-2018-5784-8be40752","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef","target":{"file":"contrib/addtiffo/tif_overview.c"}},{"signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef","target":{"file":"tools/tiffcrop.c"},"deprecated":false,"digest":{"line_hashes":["172353140212210332738028602722684502789","253628019908197467971345379500435746871","314230488715923400105651815237839916662","77322807136046078891198257595381707816","69718155279689978593491466533212242267","216893751462658506253463015470644614992","302612334229579431412840180403522687990","63355102319794581852982502112322842388","228539468221171595535354674831310576492","19616000769208776864051079112019526069"],"threshold":0.9},"id":"CVE-2018-5784-af240c7b","signature_type":"Line"},{"digest":{"function_hash":"98152871295658607399717771184892726884","length":5554},"id":"CVE-2018-5784-d6b69b9f","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/libtiff/libtiff@473851d211cf8805a161820337ca74cc9615d6ef","target":{"file":"tools/tiffcrop.c","function":"main"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}