LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | amazon-linux-2023-upgrade-libtiffamazon-linux-2023-upgrade-libtiff-debuginfoamazon-linux-2023-upgrade-libtiff-debugsourceamazon-linux-2023-upgrade-libtiff-develamazon-linux-2023-upgrade-libtiff-staticamazon-linux-2023-upgrade-libtiff-toolsamazon-linux-2023-upgrade-libtiff-tools-debuginfo | Feb 17, 2025 | May 11, 2022 | |
| Apple Osx Imageio | apple-osx-upgrade-latest | Oct 28, 2022 | May 11, 2022 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | May 11, 2022 | |
| Debian | debian-upgrade-tiff | Jan 31, 2023 | May 11, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-tiff | Oct 31, 2022 | May 11, 2022 | |
| Suse | — | suse-upgrade-libtiff-develsuse-upgrade-libtiff-devel-32bitsuse-upgrade-libtiff5suse-upgrade-libtiff5-32bitsuse-upgrade-tiff | Dec 13, 2023 | May 11, 2022 |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | May 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub