CVE-2017-9935: Canonical Ubuntu Linux

High severity, CVSS 8.8. EPSS: 3.9% chance of exploitation in the next 30 days.

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Libtiff Libtiff: up to and including 4.0.8

Published 2017-06-26. Last modified 2026-06-17.