CVE-2018-10779

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.maptools.org/show_bug.cgi?id=2788Exploit, Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/104089Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2053
https://usn.ubuntu.com/3906-1/Third Party Advisory
https://usn.ubuntu.com/3906-2/
http://bugzilla.maptools.org/show_bug.cgi?id=2788Exploit, Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/104089Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2053
https://usn.ubuntu.com/3906-1/Third Party Advisory
https://usn.ubuntu.com/3906-2/

Timeline

Published: May 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10789.8OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should CVE-2018-107806.5Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read.CVE-2018-10796.5pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of t CVE-2018-107907.5The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), r CVE-2018-107958.8Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be a CVE-2018-107967.8In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un CVE-2018-107986.5A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code t CVE-2018-107996.5A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL f CVE-2018-10808.1Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL CVE-2018-108016.5TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff.CVE-2018-108036.1Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (b CVE-2018-108046.5ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c.