An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tiff | Sep 20, 2017 | Jan 6, 2017 |
| Amazon_linux | — | Upgrade libtiffUpgrade compat-libtiff3 | Mar 7, 2017 | Jan 6, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 6, 2017 |
| Centos_linux | — | Upgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-staticUpgrade libtiff-develUpgrade libtiff-tools | Feb 1, 2017 | Jan 6, 2017 |
| Debian | — | Upgrade tiff | Jan 14, 2017 | Jan 6, 2017 |
| Freebsd | — | Upgrade linux-c6-libtiffUpgrade tiffUpgrade linux-c7-libtiffUpgrade linux-c7-tiffUpgrade linux-c6-tiff | Feb 7, 2017 | Feb 6, 2017 |
| Gentoo Linux | — | Upgrade media-libs/tiff. | Oct 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Oracle_linux | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-toolsUpgrade libtiff-devel | Feb 2, 2017 | Oct 25, 2016 |
| Redhat_linux | — | Upgrade libtiff-develUpgrade libtiff-staticNo solution existsUpgrade libtiff-toolsUpgrade libtiffUpgrade libtiff-debuginfo | Feb 3, 2017 | Jan 6, 2017 |
| Suse | — | Upgrade libtiff3-32bitUpgrade libtiff-develUpgrade libtiff5Upgrade libtiff5-32bitUpgrade tiffUpgrade libtiff3Upgrade libtiff3-x86Upgrade libtiff-devel-32bit | Jan 6, 2017 | Jan 6, 2017 |
| Ubuntu | — | Upgrade libtiff5Upgrade libtiff-tools | Feb 28, 2017 | Jan 6, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub