CVE-2017-9937

What it actually does

A malformed TIFF image triggers a malloc failure inside the JBIG decoder in tif_jbig.c, causing the calling process to abort.

Why it matters to the business

Applications that process untrusted images can be forced offline, interrupting services that rely on image handling and requiring manual restarts or failover.

How an attack unfolds

An attacker crafts a TIFF file containing a JBIG image that forces a memory allocation failure, then delivers the file to any application or service using the vulnerable LibTIFF library; the process handling the image terminates, producing a denial of service.

How to fix it

Upgrade the LibTIFF library to a version that correctly handles the allocation failure without aborting; for affected packages such as filebeat-fips, deploy the release that contains the fix (version 0 or later).

How to confirm the fix worked

Confirm the installed LibTIFF version is newer than 4.0.8, reprocess a set of known-good and malformed test images, and verify the process no longer aborts on the malformed input.

Typical attack path

1. Identify a target service that accepts or renders TIFF images via LibTIFF
2. Generate or obtain a specially malformed TIFF containing a JBIG segment designed to trigger malloc failure
3. Deliver the crafted file through upload, email attachment, or network request
4. Trigger image processing, causing the process to abort and the service to become unavailable

How to detect it

Review application and system logs for sudden process terminations or abort signals during TIFF processing; correlate with file uploads or image rendering events around the same timestamp.

What your security team should do

• Prioritize patching LibTIFF in all image-processing pipelines within the next maintenance window
• Add file-type validation and sandboxing for untrusted TIFF content until patches are applied
• Monitor for availability alerts on services that ingest images