Every CVE Search/ Get API key

CVE-2014-9330

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a...

5.0 MediumFix available

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Exploit likelihood

4.13%Up 2.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
CVE-2014-9330
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
CVE-2014-9330
Updated
2026-11-02
EUVDEUVD-2014-9155 No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
EUVD-2014-9155
Updated
2026-11-03
GitHub AdvisoriesGHSA-69w2-3hr8-2mv2 No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a...

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
GHSA-69w2-3hr8-2mv2
Updated
2026-11-02
OSVRHSA-2016:1546 6.3

Red Hat Security Advisory: libtiff security update

Record
RHSA-2016:1546
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2016:1547 6.3

Red Hat Security Advisory: libtiff security update

Record
RHSA-2016:1547
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 4 moreShow less
OSV No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
CVE-2014-9330
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9330 No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
DEBIAN-CVE-2014-9330
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9330 No score

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

Record
UBUNTU-CVE-2014-9330
Updated
2026-11-02
OSVUSN-2553-1 No score

tiff vulnerabilities

William Robinet discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130)

Paris Zoumpouloglou discovered that LibTIFF incorrectly handled certain malformed BMP images. If a user or automated system were tricked into opening a specially crafted BMP image, a remote attacker could crash the application, leading to a denial of service. (CVE-2014-9330)

Michal Zalewski discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2014-9655)

Record
USN-2553-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tiff
Debian:12
 before 4.0.3-12
4.0.3-12
tiff
Debian:13
 before 4.0.3-12
4.0.3-12
tiff
Debian:14
 before 4.0.3-12
4.0.3-12
tiff
Debian:6.0
From an advisory covering 5 CVEs
 before 3.9.4-5+squeeze12, plus listed versions
3.9.4-53.9.4-5+squeeze13.9.4-5+squeeze103.9.4-5+squeeze113.9.4-5+squeeze2
Show 7 moreShow less
3.9.4-5+squeeze33.9.4-5+squeeze43.9.4-5+squeeze53.9.4-5+squeeze63.9.4-5+squeeze73.9.4-5+squeeze83.9.4-5+squeeze9
3.9.4-5+squeeze12
tiff
Debian:7
From an advisory covering 6 CVEs
 before 4.0.2-6+deb7u4, plus listed versions
4.0.2-64.0.2-6+deb7u14.0.2-6+deb7u24.0.2-6+deb7u3
4.0.2-6+deb7u4
libtiff
Red Hat:enterprise_linux:7::client
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-static
Red Hat:enterprise_linux:7::client
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-tools
Red Hat:enterprise_linux:7::client
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
Show 33 moreShow less
Affected packages
PackageAffectedFixed
libtiff
Red Hat:enterprise_linux:7::computenode
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-static
Red Hat:enterprise_linux:7::computenode
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-tools
Red Hat:enterprise_linux:7::computenode
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff
Red Hat:enterprise_linux:7::server
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-static
Red Hat:enterprise_linux:7::server
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-tools
Red Hat:enterprise_linux:7::server
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff
Red Hat:enterprise_linux:7::workstation
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-static
Red Hat:enterprise_linux:7::workstation
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff-tools
Red Hat:enterprise_linux:7::workstation
From an advisory covering 19 CVEs
 before 0:4.0.3-25.el7_2
0:4.0.3-25.el7_2
libtiff
Red Hat:enterprise_linux:6::client
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-static
Red Hat:enterprise_linux:6::client
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff
Red Hat:enterprise_linux:6::computenode
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-static
Red Hat:enterprise_linux:6::computenode
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff
Red Hat:enterprise_linux:6::server
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-static
Red Hat:enterprise_linux:6::server
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff
Red Hat:enterprise_linux:6::workstation
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
libtiff-static
Red Hat:enterprise_linux:6::workstation
From an advisory covering 19 CVEs
 before 0:3.9.4-18.el6_8
0:3.9.4-18.el6_8
tiff
Ubuntu:14.04:LTS
 before 4.0.3-7ubuntu0.2, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-74.0.3-7ubuntu0.1
4.0.3-7ubuntu0.2
tiff
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
 before 4.0.3-7ubuntu0.2, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-74.0.3-7ubuntu0.1
4.0.3-7ubuntu0.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9330 is a medium vulnerability (CVSS 5.0) in Libtiff, published January 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.13%, the 90th percentile. Fixed in tiff 4.0.3-12.

References

Show 92 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open