Every CVE Search/ Get API key

CVE-2023-30774

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue...

5.5 MediumFix available

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.51%Up 0.4 points since May 20, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
CVE-2023-30774
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CVE List No score

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
CVE-2023-30774
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2023-35137 No score

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
EUVD-2023-35137
Updated
2026-11-03
GitHub AdvisoriesGHSA-3rqj-8cc4-p9rh 5.5

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue...

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
GHSA-3rqj-8cc4-p9rh
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSVAZL-44023 5.5

CVE-2023-30774 affecting package openjpeg2 2.3.1-12

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
AZL-44023
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-44907 5.5

CVE-2023-30774 affecting package openjpeg2 2.3.1-12

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
AZL-44907
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-05
Show 7 moreShow less
OSVBELL-CVE-2023-30774 5.5
Record
BELL-CVE-2023-30774
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-30774 5.5

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
DEBIAN-CVE-2023-30774
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2025-302 5.5

A vulnerability was found in the libtiff library

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
JLSEC-2025-302
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:2340 8.8

Red Hat Security Advisory: libtiff security update

Record
RHSA-2023:2340
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-30774 5.5

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
UBUNTU-CVE-2023-30774
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2023:2340 No score

Moderate: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

  • libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570)
  • libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE-2022-3597)
  • libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c (CVE-2022-3598)
  • libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c (CVE-2022-3599)
  • libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c (CVE-2022-3626)
  • libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627)
  • libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970)
  • libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c (CVE-2022-4645)
  • libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value (CVE-2023-30774)
  • libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (CVE-2023-30775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2023:2340
Updated
2026-11-02
OSV No score

A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values.

Record
CVE-2023-30774
Weakness
CWE-119
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtiff
AlmaLinux:9
From an advisory covering 10 CVEs
 before 4.4.0-7.el9
4.4.0-7.el9
libtiff-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 4.4.0-7.el9
4.4.0-7.el9
libtiff-tools
AlmaLinux:9
From an advisory covering 10 CVEs
 before 4.4.0-7.el9
4.4.0-7.el9
openjpeg2
Azure Linux:2
 through 2.3.1-12 None known
openjpeg2
Azure Linux:3
 through 2.3.1-12 None known
tiff
Alpaquita:23
 4.4.0-r1 and later None known
tiff
Alpaquita:stream
 4.4.0-r1 up to 4.5.0-r5
4.5.0-r5
tiff
BellSoft Hardened Containers:23
 4.4.0-r1 and later None known
tiff
BellSoft Hardened Containers:stream
 4.4.0-r1 up to 4.5.0-r5
4.5.0-r5
tiff
Debian:12
 before 4.4.0-5
4.4.0-5
Show 17 moreShow less
Affected packages
PackageAffectedFixed
tiff
Debian:13
 before 4.4.0-5
4.4.0-5
tiff
Debian:14
 before 4.4.0-5
4.4.0-5
Libtiff_jll
Julia
 before 4.5.1+0
4.5.1+0
libtiff
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-tools
Red Hat:enterprise_linux:9::crb
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
libtiff-tools-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 11 CVEs
 before 0:4.4.0-7.el9
0:4.4.0-7.el9
tiff
Ubuntu:Pro:14.04:LTS
 before 4.0.3-7ubuntu0.11+esm5, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7
Show 14 moreShow less
4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.104.0.3-7ubuntu0.114.0.3-7ubuntu0.11+esm14.0.3-7ubuntu0.11+esm24.0.3-7ubuntu0.11+esm34.0.3-7ubuntu0.11+esm4
4.0.3-7ubuntu0.11+esm5
tiff
Ubuntu:Pro:16.04:LTS
 before 4.0.6-1ubuntu0.8+esm7, plus listed versions
4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.2
Show 11 moreShow less
4.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.54.0.6-1ubuntu0.64.0.6-1ubuntu0.74.0.6-1ubuntu0.84.0.6-1ubuntu0.8+esm14.0.6-1ubuntu0.8+esm24.0.6-1ubuntu0.8+esm34.0.6-1ubuntu0.8+esm44.0.6-1ubuntu0.8+esm6
4.0.6-1ubuntu0.8+esm7
tiff
Ubuntu:18.04:LTS
 before 4.0.9-5ubuntu0.8, plus listed versions
4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3
Show 10 moreShow less
4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.14.0.9-5ubuntu0.24.0.9-5ubuntu0.34.0.9-5ubuntu0.44.0.9-5ubuntu0.54.0.9-5ubuntu0.64.0.9-5ubuntu0.7
4.0.9-5ubuntu0.8
tiff
Ubuntu:20.04:LTS
 before 4.1.0+git191117-2ubuntu0.20.04.6, plus listed versions
4.0.10+git191003-14.1.0+git191117-14.1.0+git191117-24.1.0+git191117-2build14.1.0+git191117-2ubuntu0.20.04.1
Show 4 moreShow less
4.1.0+git191117-2ubuntu0.20.04.24.1.0+git191117-2ubuntu0.20.04.34.1.0+git191117-2ubuntu0.20.04.44.1.0+git191117-2ubuntu0.20.04.5
4.1.0+git191117-2ubuntu0.20.04.6
tiff
Ubuntu:22.04:LTS
 before 4.3.0-6ubuntu0.2, plus listed versions
4.3.0-14.3.0-24.3.0-34.3.0-3build14.3.0-44.3.0-54.3.0-64.3.0-6ubuntu0.1
4.3.0-6ubuntu0.2

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30774 is a medium vulnerability (CVSS 5.5) in Libtiff, published May 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in tiff 4.5.0-r5.

References

Show 64 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open