CVE-2010-2596
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps,...
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
Exploit likelihood
What each source reports
NVD Score used
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
CVE-2010-2596- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
CVE-2010-2596- Updated
- 2026-11-02
EUVDEUVD-2010-2600 No score
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
EUVD-2010-2600- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57w4-vrmq-368j No score
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps,...
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
GHSA-57w4-vrmq-368j- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
CVE-2010-2596- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2596 No score
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."
- Record
DEBIAN-CVE-2010-2596- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tiffDebian:12 |
before 4.0.6-1 | 4.0.6-1 |
tiffDebian:13 |
before 4.0.6-1 | 4.0.6-1 |
tiffDebian:14 |
before 4.0.6-1 | 4.0.6-1 |
tiff3Debian:7 |
before 3.9.6-11+deb7u1, plus listed versions 3.9.6-11 |
3.9.6-11+deb7u1 |
libtiffRed Hat:enterprise_linux:6::client |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-develRed Hat:enterprise_linux:6::client |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-staticRed Hat:enterprise_linux:6::client |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiffRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtiff-develRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-staticRed Hat:enterprise_linux:6::computenode |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiffRed Hat:enterprise_linux:6::server |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-develRed Hat:enterprise_linux:6::server |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-staticRed Hat:enterprise_linux:6::server |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiffRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-develRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
libtiff-staticRed Hat:enterprise_linux:6::workstation |
before 0:3.9.4-10.el6_5 | 0:3.9.4-10.el6_5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2596 is a medium vulnerability (CVSS 4.3) in Libtiff, published July 1, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in tiff 4.0.6-1.
References
marc.info?l=oss-security&m=127731610612908&w=2
bugzilla.maptools.org/show_bug.cgi?id=2209
security.gentoo.org/glsa/glsa-201209-02.xml
secunia.com/advisories/40422
bugzilla.redhat.com/show_bug.cgi?id=583081
Show 33 moreShow less
nvd.nist.gov/vuln/detail/CVE-2010-2596
github.com/advisories/GHSA-57w4-vrmq-368j
security-tracker.debian.org/tracker/CVE-2010-2596
access.redhat.com/errata/RHSA-2014:0222
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0222.json
cve.org/CVERecord?id=CVE-2010-2596