LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiff-toolsUpgrade libtiff-develUpgrade libtiff | May 15, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade tiff | Aug 22, 2024 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade libtiffUpgrade libtiff-staticUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-tools-debuginfoUpgrade libtiff-toolsUpgrade libtiff-devel | Feb 17, 2025 | Mar 1, 2023 |
| Centos_linux | — | Upgrade libtiff-tools-debuginfoUpgrade libtiffUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-devel | May 15, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade tiff | Mar 6, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtiff | May 10, 2023 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-tools | May 17, 2023 | Mar 1, 2023 |
| Redhat_linux | — | Upgrade libtiff-develUpgrade libtiff-debugsourceUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfoUpgrade libtiff-toolsNo solution existsUpgrade libtiff | May 15, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade libtiff-tools-debuginfoUpgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-debuginfoUpgrade libtiff-develUpgrade libtiff-debugsource | Jun 17, 2024 | Mar 3, 2023 |
| Ubuntu | — | Upgrade tiff (Ubuntu Pro)Upgrade tiff | Nov 19, 2024 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub