An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tiff | Sep 20, 2017 | Jan 6, 2017 |
| Amazon_linux | — | Upgrade libtiffUpgrade compat-libtiff3 | Mar 7, 2017 | Jan 6, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 6, 2017 |
| Centos_linux | — | Upgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff-static | Feb 1, 2017 | Jan 6, 2017 |
| Debian | — | Upgrade tiff | Jan 14, 2017 | Jan 6, 2017 |
| Freebsd | — | Upgrade linux-c7-tiffUpgrade linux-c6-tiffUpgrade linux-c6-libtiffUpgrade linux-c7-libtiffUpgrade tiff | Feb 7, 2017 | Feb 6, 2017 |
| Gentoo Linux | — | Upgrade media-libs/tiff. | Oct 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade compat-libtiff3 | Nov 30, 2017 | Jan 6, 2017 |
| Oracle_linux | — | Upgrade libtiff-staticUpgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-devel | Feb 2, 2017 | Oct 25, 2016 |
| Redhat_linux | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-staticNo solution existsUpgrade libtiff-toolsUpgrade libtiff-debuginfo | Feb 3, 2017 | Jan 6, 2017 |
| Suse | — | Upgrade libtiff-devel-32bitUpgrade tiffUpgrade libtiff3-x86Upgrade libtiff3Upgrade libtiff3-32bitUpgrade libtiff5Upgrade libtiff5-32bitUpgrade libtiff-devel | Jan 6, 2017 | Jan 6, 2017 |
| Ubuntu | — | Upgrade libtiff-toolsUpgrade libtiff5 | Feb 28, 2017 | Jan 6, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub