An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tiff | Sep 20, 2017 | Jan 6, 2017 |
| Amazon_linux | — | Upgrade libtiffUpgrade compat-libtiff3 | Mar 7, 2017 | Jan 6, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 6, 2017 |
| Centos_linux | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-debuginfoUpgrade libtiff-devel | Feb 1, 2017 | Jan 6, 2017 |
| Debian | — | Upgrade tiff | Jan 14, 2017 | Jan 6, 2017 |
| Freebsd | — | Upgrade linux-c6-tiffUpgrade linux-c7-tiffUpgrade tiffUpgrade linux-c6-libtiffUpgrade linux-c7-libtiff | Feb 7, 2017 | Feb 6, 2017 |
| Gentoo Linux | — | Upgrade media-libs/tiff. | Oct 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-staticUpgrade libtiff-tools | Feb 2, 2017 | Oct 25, 2016 |
| Redhat_linux | — | Upgrade libtiff-develNo solution existsUpgrade libtiffUpgrade libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-debuginfo | Feb 3, 2017 | Jan 6, 2017 |
| Suse | — | Upgrade libtiff-devel-32bitUpgrade tiffUpgrade libtiff3Upgrade libtiff3-x86Upgrade libtiff5Upgrade libtiff5-32bitUpgrade libtiff-develUpgrade libtiff3-32bit | Jan 6, 2017 | Jan 6, 2017 |
| Ubuntu | — | Upgrade libtiff-toolsUpgrade libtiff5 | Feb 28, 2017 | Jan 6, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub