The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libtiff-develUpgrade libtiff | Dec 1, 2016 | Jul 2, 2010 |
| Debian | — | Upgrade tiff | Jul 30, 2024 | Jul 2, 2010 |
| Gentoo Linux | — | Upgrade media-libs/tiff. | Oct 30, 2017 | Jul 2, 2010 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade libtiff | Oct 16, 2024 | Jul 1, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2010 |
| Ubuntu | — | Upgrade libtiff4 | Nov 8, 2024 | Jul 2, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub