Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade libtiff | Aug 22, 2016 | Jan 20, 2015 |
| Centos_linux | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-static | Aug 6, 2016 | Jan 20, 2015 |
| Debian | — | Upgrade tiff | Jul 30, 2024 | Jan 20, 2015 |
| Gentoo Linux | — | Upgrade media-libs/tiff. | Oct 30, 2017 | Jan 20, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 20, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 20, 2015 |
| Oracle Solaris | — | Upgrade image/library/libtiff to version 3.9.5-0.175.3.9.0.3.0 on Solaris 11.3Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | May 29, 2017 | Jan 20, 2015 |
| Oracle_linux | — | Upgrade libtiff-toolsUpgrade libtiff-staticUpgrade libtiff-develUpgrade libtiff | Aug 2, 2016 | Dec 22, 2014 |
| Redhat_linux | — | No solution existsUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff-develUpgrade libtiffUpgrade libtiff-tools | Aug 2, 2016 | Jan 20, 2015 |
| Ubuntu | — | Upgrade libtiff4Upgrade libtiff5 | Nov 8, 2024 | Jan 20, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub