LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiff-toolsUpgrade libtiffUpgrade libtiff-devel | May 15, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade tiff | Aug 22, 2024 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-debugsourceUpgrade libtiff-debuginfoUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-devel | Feb 17, 2025 | Mar 1, 2023 |
| Centos_linux | — | Upgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-tools-debuginfo | May 15, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade tiff | Mar 6, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtiff | May 10, 2023 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff | May 17, 2023 | Mar 1, 2023 |
| Redhat_linux | — | Upgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfoNo solution existsUpgrade libtiff-toolsUpgrade libtiff | May 15, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-toolsUpgrade libtiff | Jun 17, 2024 | Mar 3, 2023 |
| Ubuntu | — | Upgrade tiff (Ubuntu Pro)Upgrade tiff | Nov 19, 2024 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub