Vulnerability-Lookup

SUSE-SU-2026:22234-1

Vulnerability from csaf_suse - Published: 2026-06-21 02:13 - Updated: 2026-06-21 02:13

Summary

Security update for tiff

Severity

Important

Notes

Title of the patch: Security update for tiff

Description of the patch: This update for tiff fixes the following issues Security issues: - CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow (bsc#1248278). - CVE-2026-4775: signed integer overflow in the `putcontig8bitYCbCr44tile` function (bsc#1260411). Non security issue: - QGIS can't export with GDAL- LERC codec, LERC library not found anywhere in the system (bsc#1257123).

Patchnames: SUSE-SL-Micro-6.2-1007

CVE-2018-7456

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-0800

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-0801

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-0802

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-0803

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2023-0804

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-8851

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-4775

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64	—	Vendor Fix

Threats

Impact important

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1248278	self
https://bugzilla.suse.com/1257123	self
https://bugzilla.suse.com/1260411	self
https://www.suse.com/security/cve/CVE-2018-7456/	self
https://www.suse.com/security/cve/CVE-2023-0800/	self
https://www.suse.com/security/cve/CVE-2023-0801/	self
https://www.suse.com/security/cve/CVE-2023-0802/	self
https://www.suse.com/security/cve/CVE-2023-0803/	self
https://www.suse.com/security/cve/CVE-2023-0804/	self
https://www.suse.com/security/cve/CVE-2025-8851/	self
https://www.suse.com/security/cve/CVE-2026-4775/	self
https://www.suse.com/security/cve/CVE-2018-7456	external
https://bugzilla.suse.com/1074317	external
https://bugzilla.suse.com/1082825	external
https://www.suse.com/security/cve/CVE-2023-0800	external
https://bugzilla.suse.com/1208231	external
https://www.suse.com/security/cve/CVE-2023-0801	external
https://bugzilla.suse.com/1208232	external
https://www.suse.com/security/cve/CVE-2023-0802	external
https://bugzilla.suse.com/1208233	external
https://www.suse.com/security/cve/CVE-2023-0803	external
https://bugzilla.suse.com/1208234	external
https://www.suse.com/security/cve/CVE-2023-0804	external
https://bugzilla.suse.com/1208236	external
https://www.suse.com/security/cve/CVE-2025-8851	external
https://bugzilla.suse.com/1248274	external
https://www.suse.com/security/cve/CVE-2026-4775	external
https://bugzilla.suse.com/1260411	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tiff",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tiff fixes the following issues\n\nSecurity issues:\n\n- CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow (bsc#1248278).\n- CVE-2026-4775: signed integer overflow in the `putcontig8bitYCbCr44tile` function (bsc#1260411).\n\nNon security issue:\n\n- QGIS can\u0027t export with GDAL- LERC codec, LERC library not found anywhere in the system (bsc#1257123).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-1007",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22234-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22234-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622234-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22234-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047474.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248278",
        "url": "https://bugzilla.suse.com/1248278"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257123",
        "url": "https://bugzilla.suse.com/1257123"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260411",
        "url": "https://bugzilla.suse.com/1260411"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-7456 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-7456/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0800 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0800/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0801 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0801/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0802 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0802/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0803 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0803/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0804 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0804/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-8851 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-8851/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-4775 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-4775/"
      }
    ],
    "title": "Security update for tiff",
    "tracking": {
      "current_release_date": "2026-06-21T02:13:32Z",
      "generator": {
        "date": "2026-06-21T02:13:32Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22234-1",
      "initial_release_date": "2026-06-21T02:13:32Z",
      "revision_history": [
        {
          "date": "2026-06-21T02:13:32Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff6-4.7.1-160000.2.1.aarch64",
                "product": {
                  "name": "libtiff6-4.7.1-160000.2.1.aarch64",
                  "product_id": "libtiff6-4.7.1-160000.2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff6-4.7.1-160000.2.1.ppc64le",
                "product": {
                  "name": "libtiff6-4.7.1-160000.2.1.ppc64le",
                  "product_id": "libtiff6-4.7.1-160000.2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff6-4.7.1-160000.2.1.s390x",
                "product": {
                  "name": "libtiff6-4.7.1-160000.2.1.s390x",
                  "product_id": "libtiff6-4.7.1-160000.2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff6-4.7.1-160000.2.1.x86_64",
                "product": {
                  "name": "libtiff6-4.7.1-160000.2.1.x86_64",
                  "product_id": "libtiff6-4.7.1-160000.2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:transactional"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.7.1-160000.2.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64"
        },
        "product_reference": "libtiff6-4.7.1-160000.2.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.7.1-160000.2.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le"
        },
        "product_reference": "libtiff6-4.7.1-160000.2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.7.1-160000.2.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x"
        },
        "product_reference": "libtiff6-4.7.1-160000.2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.7.1-160000.2.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        },
        "product_reference": "libtiff6-4.7.1-160000.2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-7456",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-7456"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-7456",
          "url": "https://www.suse.com/security/cve/CVE-2018-7456"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074317 for CVE-2018-7456",
          "url": "https://bugzilla.suse.com/1074317"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082825 for CVE-2018-7456",
          "url": "https://bugzilla.suse.com/1082825"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-7456"
    },
    {
      "cve": "CVE-2023-0800",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0800"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0800",
          "url": "https://www.suse.com/security/cve/CVE-2023-0800"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208231 for CVE-2023-0800",
          "url": "https://bugzilla.suse.com/1208231"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0800"
    },
    {
      "cve": "CVE-2023-0801",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0801"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0801",
          "url": "https://www.suse.com/security/cve/CVE-2023-0801"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208232 for CVE-2023-0801",
          "url": "https://bugzilla.suse.com/1208232"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0801"
    },
    {
      "cve": "CVE-2023-0802",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0802"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0802",
          "url": "https://www.suse.com/security/cve/CVE-2023-0802"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208233 for CVE-2023-0802",
          "url": "https://bugzilla.suse.com/1208233"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0802"
    },
    {
      "cve": "CVE-2023-0803",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0803"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0803",
          "url": "https://www.suse.com/security/cve/CVE-2023-0803"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208234 for CVE-2023-0803",
          "url": "https://bugzilla.suse.com/1208234"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0803"
    },
    {
      "cve": "CVE-2023-0804",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0804"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0804",
          "url": "https://www.suse.com/security/cve/CVE-2023-0804"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208236 for CVE-2023-0804",
          "url": "https://bugzilla.suse.com/1208236"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0804"
    },
    {
      "cve": "CVE-2025-8851",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-8851"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-8851",
          "url": "https://www.suse.com/security/cve/CVE-2025-8851"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248274 for CVE-2025-8851",
          "url": "https://bugzilla.suse.com/1248274"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-8851"
    },
    {
      "cve": "CVE-2026-4775",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-4775"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
          "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-4775",
          "url": "https://www.suse.com/security/cve/CVE-2026-4775"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260411 for CVE-2026-4775",
          "url": "https://bugzilla.suse.com/1260411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.aarch64",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.ppc64le",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.s390x",
            "SUSE Linux Micro 6.2:libtiff6-4.7.1-160000.2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-21T02:13:32Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-4775"
    }
  ]
}

CVE-2018-7456 (GCVE-0-2018-7456)

Vulnerability from cvelistv5 – Published: 2018-02-24 06:00 – Updated: 2024-08-05 06:24

Summary

A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)

Severity

No CVSS data available.

CWE

Assigner

mitre

References

10 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3864-1/	vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4349	vendor-advisoryx_refsource_DEBIAN
https://github.com/xiaoqx/pocs/tree/master/libtiff	x_refsource_MISC
http://bugzilla.maptools.org/show_bug.cgi?id=2778	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://gitlab.com/libtiff/libtiff/commit/be4c85b…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:2051	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2053	vendor-advisoryx_refsource_REDHAT

Date Public

2018-02-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:24:12.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1347-1] tiff3 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00011.html"
          },
          {
            "name": "USN-3864-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3864-1/"
          },
          {
            "name": "DSA-4349",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4349"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/xiaoqx/pocs/tree/master/libtiff"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2778"
          },
          {
            "name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"
          },
          {
            "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1346-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00010.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b"
          },
          {
            "name": "RHSA-2019:2051",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2051"
          },
          {
            "name": "RHSA-2019:2053",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2053"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-02-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-29T19:42:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1347-1] tiff3 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00011.html"
        },
        {
          "name": "USN-3864-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3864-1/"
        },
        {
          "name": "DSA-4349",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4349"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xiaoqx/pocs/tree/master/libtiff"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2778"
        },
        {
          "name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"
        },
        {
          "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1346-1] tiff security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00010.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b"
        },
        {
          "name": "RHSA-2019:2051",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2051"
        },
        {
          "name": "RHSA-2019:2053",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2053"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-7456",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1347-1] tiff3 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00011.html"
            },
            {
              "name": "USN-3864-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3864-1/"
            },
            {
              "name": "DSA-4349",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4349"
            },
            {
              "name": "https://github.com/xiaoqx/pocs/tree/master/libtiff",
              "refsource": "MISC",
              "url": "https://github.com/xiaoqx/pocs/tree/master/libtiff"
            },
            {
              "name": "http://bugzilla.maptools.org/show_bug.cgi?id=2778",
              "refsource": "MISC",
              "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2778"
            },
            {
              "name": "[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html"
            },
            {
              "name": "[debian-lts-announce] 20180416 [SECURITY] [DLA 1346-1] tiff security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00010.html"
            },
            {
              "name": "https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b"
            },
            {
              "name": "RHSA-2019:2051",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2051"
            },
            {
              "name": "RHSA-2019:2053",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2053"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-7456",
    "datePublished": "2018-02-24T06:00:00.000Z",
    "dateReserved": "2018-02-23T00:00:00.000Z",
    "dateUpdated": "2024-08-05T06:24:12.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0800 (GCVE-0-2023-0800)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 19:01

Summary

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Out-of-bounds write in libtiff
CWE-787 - Out-of-bounds Write

Assigner

GitLab

References

7 references

URL	Tags
https://gitlab.com/libtiff/libtiff/-/issues/496
https://gitlab.com/libtiff/libtiff/-/commit/33aee…
https://gitlab.com/gitlab-org/cves/-/blob/master/…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5361	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…
https://security.gentoo.org/glsa/202305-31	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libtiff	libtiff	Affected: <=4.4.0

Credits

wangdw.augustus@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/496"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0800.json"
          },
          {
            "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
          },
          {
            "name": "DSA-5361",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5361"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
          },
          {
            "name": "GLSA-202305-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-31"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0800",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T19:01:02.428402Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T19:01:06.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libtiff",
          "vendor": "libtiff",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=4.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "wangdw.augustus@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in libtiff",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-30T00:00:00.000Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/496"
        },
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0800.json"
        },
        {
          "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
        },
        {
          "name": "DSA-5361",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5361"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
        },
        {
          "name": "GLSA-202305-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2023-0800",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-12T00:00:00.000Z",
    "dateUpdated": "2025-03-21T19:01:06.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0801 (GCVE-0-2023-0801)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 19:00

Summary

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Out-of-bounds write in libtiff
CWE-787 - Out-of-bounds Write

Assigner

GitLab

References

7 references

URL	Tags
https://gitlab.com/libtiff/libtiff/-/commit/33aee…
https://gitlab.com/libtiff/libtiff/-/issues/498
https://gitlab.com/gitlab-org/cves/-/blob/master/…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5361	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…
https://security.gentoo.org/glsa/202305-31	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libtiff	libtiff	Affected: <=4.4.0

Credits

wangdw.augustus@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.481Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/498"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0801.json"
          },
          {
            "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
          },
          {
            "name": "DSA-5361",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5361"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
          },
          {
            "name": "GLSA-202305-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-31"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0801",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T19:00:40.946137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T19:00:43.776Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libtiff",
          "vendor": "libtiff",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=4.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "wangdw.augustus@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in libtiff",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-30T00:00:00.000Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
        },
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/498"
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0801.json"
        },
        {
          "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
        },
        {
          "name": "DSA-5361",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5361"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
        },
        {
          "name": "GLSA-202305-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2023-0801",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-12T00:00:00.000Z",
    "dateUpdated": "2025-03-21T19:00:43.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0802 (GCVE-0-2023-0802)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 18:59

Summary

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Out-of-bounds write in libtiff
CWE-787 - Out-of-bounds Write

Assigner

GitLab

References

7 references

URL	Tags
https://gitlab.com/libtiff/libtiff/-/commit/33aee…
https://gitlab.com/libtiff/libtiff/-/issues/500
https://gitlab.com/gitlab-org/cves/-/blob/master/…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5361	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…
https://security.gentoo.org/glsa/202305-31	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libtiff	libtiff	Affected: <=4.4.0

Credits

wangdw.augustus@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.508Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/500"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0802.json"
          },
          {
            "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
          },
          {
            "name": "DSA-5361",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5361"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
          },
          {
            "name": "GLSA-202305-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-31"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0802",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T18:59:46.718616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T18:59:50.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libtiff",
          "vendor": "libtiff",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=4.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "wangdw.augustus@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in libtiff",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-30T00:00:00.000Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
        },
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/500"
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0802.json"
        },
        {
          "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
        },
        {
          "name": "DSA-5361",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5361"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
        },
        {
          "name": "GLSA-202305-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2023-0802",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-12T00:00:00.000Z",
    "dateUpdated": "2025-03-21T18:59:50.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0803 (GCVE-0-2023-0803)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 18:55

Summary

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Out-of-bounds write in libtiff
CWE-787 - Out-of-bounds Write

Assigner

GitLab

References

7 references

URL	Tags
https://gitlab.com/libtiff/libtiff/-/commit/33aee…
https://gitlab.com/libtiff/libtiff/-/issues/501
https://gitlab.com/gitlab-org/cves/-/blob/master/…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5361	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…
https://security.gentoo.org/glsa/202305-31	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libtiff	libtiff	Affected: <=4.4.0

Credits

wangdw.augustus@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/501"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0803.json"
          },
          {
            "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
          },
          {
            "name": "DSA-5361",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5361"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
          },
          {
            "name": "GLSA-202305-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-31"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0803",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T18:54:51.966287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T18:55:10.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libtiff",
          "vendor": "libtiff",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=4.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "wangdw.augustus@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in libtiff",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-30T00:00:00.000Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
        },
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/501"
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0803.json"
        },
        {
          "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
        },
        {
          "name": "DSA-5361",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5361"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0002/"
        },
        {
          "name": "GLSA-202305-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2023-0803",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-12T00:00:00.000Z",
    "dateUpdated": "2025-03-21T18:55:10.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0804 (GCVE-0-2023-0804)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-03-21 14:47

Summary

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Out-of-bounds write in libtiff
CWE-787 - Out-of-bounds Write

Assigner

GitLab

References

8 references

URL	Tags
https://gitlab.com/libtiff/libtiff/-/commit/33aee…
https://gitlab.com/libtiff/libtiff/-/issues/497
https://gitlab.com/gitlab-org/cves/-/blob/master/…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5361	vendor-advisory
https://security.netapp.com/advisory/ntap-2023032…
https://security.gentoo.org/glsa/202305-31	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libtiff	libtiff	Affected: <=4.4.0

Credits

wangdw.augustus@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.485Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/497"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0804.json"
          },
          {
            "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
          },
          {
            "name": "DSA-5361",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5361"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230324-0009/"
          },
          {
            "name": "GLSA-202305-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-31"
          },
          {
            "name": "FEDORA-2023-8daf1023c7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBF3UUFSB6NB3NFTQSKOOIZGXJP3T34Z/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0804",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T14:46:45.718839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T14:47:39.466Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libtiff",
          "vendor": "libtiff",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=4.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "wangdw.augustus@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in libtiff",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-01T05:06:14.054Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00"
        },
        {
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/497"
        },
        {
          "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0804.json"
        },
        {
          "name": "[debian-lts-announce] 20230221 [SECURITY] [DLA 3333-1] tiff security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
        },
        {
          "name": "DSA-5361",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5361"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230324-0009/"
        },
        {
          "name": "GLSA-202305-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-31"
        },
        {
          "name": "FEDORA-2023-8daf1023c7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBF3UUFSB6NB3NFTQSKOOIZGXJP3T34Z/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2023-0804",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-12T00:00:00.000Z",
    "dateUpdated": "2025-03-21T14:47:39.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-8851 (GCVE-0-2025-8851)

Vulnerability from cvelistv5 – Published: 2025-08-11 13:32 – Updated: 2025-08-12 13:43

Title

LibTIFF tiffcrop tiffcrop.c readSeparateStripsetoBuffer stack-based overflow

Summary

A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow
CWE-119 - Memory Corruption

Assigner

VulDB

References

5 references

URL	Tags
https://vuldb.com/?id.319382	vdb-entrytechnical-description
https://vuldb.com/?ctiid.319382	signaturepermissions-required
https://vuldb.com/?submit.624604	third-party-advisory
https://gitlab.com/libtiff/libtiff/-/commit/8a7a4…	patch
http://www.libtiff.org/	product

Impacted products

1 product

Vendor	Product	Version
n/a	LibTIFF	Affected: 4.5.0 Affected: 4.5.1

Credits

arthurx (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8851",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T17:32:45.202030Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T13:43:18.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/?submit.624604"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "tiffcrop"
          ],
          "product": "LibTIFF",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0"
            },
            {
              "status": "affected",
              "version": "4.5.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "arthurx (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue."
        },
        {
          "lang": "de",
          "value": "Dies betrifft die Funktion readSeparateStripsetoBuffer der Datei tools/tiffcrop.c der Komponente tiffcrop. Durch Manipulieren mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Patch wird als 8a7a48d7a645992ca83062b3a1873c951661e2b3 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-11T13:32:08.843Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-319382 | LibTIFF tiffcrop tiffcrop.c readSeparateStripsetoBuffer stack-based overflow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.319382"
        },
        {
          "name": "VDB-319382 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.319382"
        },
        {
          "name": "Submit #624604 | LibTIFF v4.5.1 Buffer Overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.624604"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "http://www.libtiff.org/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-08-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-08-10T21:10:47.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "LibTIFF tiffcrop tiffcrop.c readSeparateStripsetoBuffer stack-based overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-8851",
    "datePublished": "2025-08-11T13:32:08.843Z",
    "dateReserved": "2025-08-10T19:05:43.677Z",
    "dateUpdated": "2025-08-12T13:43:18.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-4775 (GCVE-0-2026-4775)

Vulnerability from cvelistv5 – Published: 2026-03-24 14:42 – Updated: 2026-06-15 02:05

Title

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Summary

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

redhat

References

24 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:12265	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12271	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14929	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16055	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19150	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19363	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19586	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19604	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19608	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19657	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19659	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20583	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20591	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20592	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24992	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25096	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25910	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4775	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2450768	issue-trackingx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

31 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:4.6.0-6.el10_1.3 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:4.6.0-8.el10_2.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:4.6.0-6.el10_0.3 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.9.4-12.el7_9.2 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:4.0.3-35.el7_9.2 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.0.9-37.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:3.9.4-15.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.0.9-4.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.0.9-18.el8_4.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:3.9.4-13.el8_4.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.0.9-18.el8_4.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:3.9.4-13.el8_4.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.0.9-21.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:3.9.4-13.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:4.0.9-21.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:3.9.4-13.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:4.0.9-21.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:3.9.4-13.el8_6.2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.0.9-29.el8_8.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:3.9.4-13.el8_8.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.0.9-29.el8_8.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:3.9.4-13.el8_8.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:4.4.0-15.el9_7.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:4.4.0-18.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:4.2.0-3.el9_0.3 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:4.4.0-8.el9_2.5 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:4.4.0-12.el9_4.5 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:4.4.0-13.el9_6.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1780681984 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Date Public

2026-03-24 14:33

Credits

Red Hat would like to thank PrymEvol and Quang Luong for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4775",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T03:55:55.028Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-17T16:20:28.027Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.1"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.0-6.el10_1.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.0-8.el10_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.0-6.el10_0.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-12.el7_9.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.3-35.el7_9.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-37.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-15.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-libtiff",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-4.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-18.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-18.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-21.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-21.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-21.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-29.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.0.9-29.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "compat-libtiff3",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.9.4-13.el8_8.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.4.0-15.el9_7.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.4.0-18.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.2.0-3.el9_0.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.4.0-8.el9_2.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.4.0-12.el9_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.4.0-13.el9_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/model-opt-cuda-rhel9",
          "product": "Red Hat AI Inference Server 3.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780681984",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libtiff",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank PrymEvol and Quang Luong for reporting this issue."
        }
      ],
      "datePublic": "2026-03-24T14:33:35.730Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T02:05:30.610Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:12265",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12265"
        },
        {
          "name": "RHSA-2026:12271",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:12271"
        },
        {
          "name": "RHSA-2026:14929",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:14929"
        },
        {
          "name": "RHSA-2026:16055",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:16055"
        },
        {
          "name": "RHSA-2026:19150",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19150"
        },
        {
          "name": "RHSA-2026:19363",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19363"
        },
        {
          "name": "RHSA-2026:19585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19585"
        },
        {
          "name": "RHSA-2026:19586",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19586"
        },
        {
          "name": "RHSA-2026:19604",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19604"
        },
        {
          "name": "RHSA-2026:19608",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19608"
        },
        {
          "name": "RHSA-2026:19609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19609"
        },
        {
          "name": "RHSA-2026:19657",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19657"
        },
        {
          "name": "RHSA-2026:19659",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19659"
        },
        {
          "name": "RHSA-2026:19702",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:19702"
        },
        {
          "name": "RHSA-2026:20583",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20583"
        },
        {
          "name": "RHSA-2026:20585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20585"
        },
        {
          "name": "RHSA-2026:20591",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20591"
        },
        {
          "name": "RHSA-2026:20592",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:20592"
        },
        {
          "name": "RHSA-2026:24992",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:24992"
        },
        {
          "name": "RHSA-2026:25096",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:25096"
        },
        {
          "name": "RHSA-2026:25910",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:25910"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-4775"
        },
        {
          "name": "RHBZ#2450768",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-24T14:23:23.826Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-24T14:33:35.730Z",
          "value": "Made public."
        }
      ],
      "title": "Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF files with applications linked against the libtiff library. If processing untrusted TIFF files is unavoidable, consider running the affected applications within a sandboxed environment to limit the potential impact of successful exploitation. This operational control helps contain the effects of an out-of-bounds write, reducing the risk of denial of service or arbitrary code execution."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4775",
    "datePublished": "2026-03-24T14:42:47.529Z",
    "dateReserved": "2026-03-24T14:26:05.988Z",
    "dateUpdated": "2026-06-15T02:05:30.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:22234-1

CVE-2018-7456 (GCVE-0-2018-7456)

CVE-2023-0800 (GCVE-0-2023-0800)

CVE-2023-0801 (GCVE-0-2023-0801)

CVE-2023-0802 (GCVE-0-2023-0802)

CVE-2023-0803 (GCVE-0-2023-0803)

CVE-2023-0804 (GCVE-0-2023-0804)

CVE-2025-8851 (GCVE-0-2025-8851)

CVE-2026-4775 (GCVE-0-2026-4775)

Tags

Sightings

Nomenclature