Skip to content
Fencer Intel
medium 6.5

CVE-2018-7456 json

A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alph…

published 2018-02-24 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19187

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)

Patch / fix

  • tiff Debian 14, Debian 13, Debian 12 4.0.9-5

debian advisories DEBIAN-CVE-2018-7456

  • tiff Ubuntu 14.04 LTS 4.0.3-7ubuntu0.10
  • tiff Ubuntu 16.04 LTS 4.0.6-1ubuntu0.5

ubuntu advisories UBUNTU-CVE-2018-7456

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libtiff RHEL 7 4.0.3-32.el7
  • libtiff-tools RHEL 7 4.0.3-32.el7
  • compat-libtiff3 RHEL 7 3.9.4-12.el7

red hat advisories RHSA-2019:2053RHSA-2019:2051

  • tiff SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.7.1-160000.2.1
  • tiff SLE Module for Desktop Applications 15, SLE Module for Basesystem 15 4.0.9-5.9.1
  • tiff SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 3.8.2-141.169.9.1
  • tiff SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 4.0.9-44.15.2

suse advisories SUSE-SU-2026:22234-1SUSE-SU-2026:22306-1SUSE-SU-2018:1889-1SUSE-SU-2018:1835-1SUSE-SU-2018:1826-1

  • tiff openSUSE Leap 16.0 4.7.1-160000.2.1
  • tiff-man openSUSE Leap 16.0 4.7.1-160000.2.1
  • tiff openSUSE Tumbleweed 4.3.0-1.3

opensuse advisories openSUSE-SU-2026:20995-1openSUSE-SU-2024:11461-1

  • tiff Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 4.0.9-r4
  • tiff Alpine 3.7, Alpine 3.6, Alpine 3.5 +1 more 4.0.9-r3

alpine advisories ALPINE-CVE-2018-7456

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • lib32-libtiff Arch Linux 4.0.10-1
  • libtiff Arch Linux 4.0.9-2

arch linux advisories AVG-791AVG-813

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-7456 updated cvss 3.3

libtiff: NULL pointer dereference in tif_print.c:TIFFPrintDirectory() causes a denial of service

  • Red Hat Enterprise Linux 5 libtiff Red Hat Enterprise Linux 6 libtiff
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) libtiff 4.0.3-32.el7, compat-libtiff3 3.9.4-12.el7
    fixed: vendor fix RHSA-2019:2051
  • Red Hat Enterprise Linux Client Optional (v. 7) libtiff-tools 4.0.3-32.el7
    fixed: vendor fix RHSA-2019:2053
  • Red Hat Enterprise Linux ComputeNode (v. 7) libtiff 4.0.3-32.el7, compat-libtiff3 3.9.4-12.el7
    fixed: vendor fix RHSA-2019:2051
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libtiff-tools 4.0.3-32.el7
    fixed: vendor fix RHSA-2019:2053
  • Red Hat Enterprise Linux Server (v. 7) libtiff 4.0.3-32.el7, compat-libtiff3 3.9.4-12.el7
    fixed: vendor fix RHSA-2019:2051
  • Red Hat Enterprise Linux Server Optional (v. 7) libtiff-tools 4.0.3-32.el7
    fixed: vendor fix RHSA-2019:2053
  • Red Hat Enterprise Linux Workstation (v. 7) libtiff 4.0.3-32.el7, compat-libtiff3 3.9.4-12.el7
    fixed: vendor fix RHSA-2019:2051
show 2 more
  • Red Hat Enterprise Linux Workstation Optional (v. 7) libtiff-tools 4.0.3-32.el7
    fixed: vendor fix RHSA-2019:2053
  • Red Hat Enterprise Linux 8 libtiff, libtiff-tools
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.99% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/xiaoqx/pocs/tree/master/libtiff referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.maptools.org http://bugzilla.maptools.org/show_bug.cgi?id=2778 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.