LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libtiffUpgrade libtiff-develUpgrade libtiff-tools | May 15, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade tiff | Aug 22, 2024 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade libtiff-staticUpgrade libtiffUpgrade libtiff-develUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-debuginfo | Feb 17, 2025 | Mar 1, 2023 |
| Centos_linux | — | Upgrade libtiff-develUpgrade libtiff-debuginfoUpgrade libtiff-debugsourceUpgrade libtiffUpgrade libtiff-tools-debuginfo | May 15, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade tiff | Mar 6, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtiff | May 10, 2023 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade libtiff-develUpgrade libtiffUpgrade libtiff-tools | May 17, 2023 | Mar 1, 2023 |
| Redhat_linux | — | Upgrade libtiff-toolsUpgrade libtiffNo solution existsUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-tools-debuginfoUpgrade libtiff-debuginfo | May 15, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade libtiffUpgrade libtiff-toolsUpgrade libtiff-tools-debuginfoUpgrade libtiff-debugsourceUpgrade libtiff-develUpgrade libtiff-debuginfo | Jun 17, 2024 | Mar 3, 2023 |
| Ubuntu | — | Upgrade tiffUpgrade tiff (Ubuntu Pro) | Nov 19, 2024 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub