LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff | May 15, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade tiff | Aug 22, 2024 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-toolsUpgrade libtiff-debugsourceUpgrade libtiff-debuginfo | Feb 17, 2025 | Mar 1, 2023 |
| Centos_linux | — | Upgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-debuginfoUpgrade libtiffUpgrade libtiff-devel | May 15, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade tiff | Mar 6, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtiff | May 10, 2023 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-devel | May 17, 2023 | Mar 1, 2023 |
| Redhat_linux | — | Upgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiffNo solution existsUpgrade libtiff-tools | May 15, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade libtiff-develUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfo | Jun 17, 2024 | Mar 3, 2023 |
| Ubuntu | — | Upgrade tiffUpgrade tiff (Ubuntu Pro) | Nov 19, 2024 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub