CVE-2017-5563

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.0.7

Description The issue is related to a heap-based buffer over-read in the tif lzw.c file, which can result in denial of service (DoS) or code execution. This can be triggered by a crafted bmp image when using the tools/bmp2tiff utility.

Recommendations For LibTIFF version 4.0.7, consider avoiding the use of crafted bmp images with the bmp2tiff tool until a patch is available. As a temporary workaround, restrict access to the tif lzw.c function to minimize the risk of exploitation.