Every CVE Search/ Get API key

CVE-2011-0192

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in...

9.3 HighFix available

CVE-2011-0192 is a high vulnerability (CVSS 9.3) in Apple Itunes, published March 3, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.47%, the 94th percentile. Fixed in tiff 3.9.4-7.

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Exploit likelihood

7.47%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
CVE-2011-0192
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
CVE-2011-0192
Updated
2026-11-02
EUVDEUVD-2011-0218 No score

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
EUVD-2011-0218
Updated
2026-11-03
GitHub AdvisoriesGHSA-8jmv-mmc9-gx7j No score

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in...

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
GHSA-8jmv-mmc9-gx7j
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
CVE-2011-0192
Updated
2026-11-02
OSVDEBIAN-CVE-2011-0192 No score

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Record
DEBIAN-CVE-2011-0192
Updated
2026-11-02
OSVopenSUSE-SU-2024:10554-1 No score

libtiff-devel-32bit-4.0.7-1.1 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10554-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tiff
Debian:12
 before 3.9.4-7
3.9.4-7
tiff
Debian:13
 before 3.9.4-7
3.9.4-7
tiff
Debian:14
 before 3.9.4-7
3.9.4-7
tiff
Debian:6.0
 before 3.9.4-5+squeeze1, plus listed versions
3.9.4-5
3.9.4-5+squeeze1
tiff
Debian:5.0
 before 3.8.2-11.4, plus listed versions
3.8.2-113.8.2-11.23.8.2-11.3
3.8.2-11.4
libtiff
Red Hat:enterprise_linux:4::as
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-devel
Red Hat:enterprise_linux:4::as
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff
Red Hat:enterprise_linux:4::desktop
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
Show 27 moreShow less
Affected packages
PackageAffectedFixed
libtiff-devel
Red Hat:enterprise_linux:4::desktop
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff
Red Hat:enterprise_linux:4::es
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-devel
Red Hat:enterprise_linux:4::es
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff
Red Hat:enterprise_linux:4::ws
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff-devel
Red Hat:enterprise_linux:4::ws
 before 0:3.6.1-17.el4
0:3.6.1-17.el4
libtiff
Red Hat:enterprise_linux:5::server
 before 0:3.8.2-7.el5_6.6
0:3.8.2-7.el5_6.6
libtiff-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.8.2-7.el5_6.6
0:3.8.2-7.el5_6.6
libtiff-devel
Red Hat:enterprise_linux:5::server
 before 0:3.8.2-7.el5_6.6
0:3.8.2-7.el5_6.6
libtiff
Red Hat:enterprise_linux:6::client
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-devel
Red Hat:enterprise_linux:6::client
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-static
Red Hat:enterprise_linux:6::client
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff
Red Hat:enterprise_linux:6::computenode
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-devel
Red Hat:enterprise_linux:6::computenode
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-static
Red Hat:enterprise_linux:6::computenode
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff
Red Hat:enterprise_linux:6::server
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-static
Red Hat:enterprise_linux:6::server
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-devel
Red Hat:enterprise_linux:6::server
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff
Red Hat:enterprise_linux:6::workstation
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-static
Red Hat:enterprise_linux:6::workstation
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
libtiff-devel
Red Hat:enterprise_linux:6::workstation
 before 0:3.9.4-1.el6_0.1
0:3.9.4-1.el6_0.1
tiff
openSUSE:Tumbleweed
 before 4.0.7-1.1
4.0.7-1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 94 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open