CVE-2015-1547

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of...

6.5 MediumFix available

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.48%Up 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: CVE-2015-1547
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: CVE-2015-1547
Updated: 2026-11-02

EUVDEUVD-2015-1681 No score

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: EUVD-2015-1681
Updated: 2026-11-03

GitHub AdvisoriesGHSA-63xc-994f-r5qr 6.5

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of...

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: GHSA-63xc-994f-r5qr
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 6.5

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: CVE-2015-1547
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-1547 6.5

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: DEBIAN-CVE-2015-1547
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVRHSA-2016:1546 6.3

Red Hat Security Advisory: libtiff security update

Record: RHSA-2016:1546
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2016:1547 6.3

Red Hat Security Advisory: libtiff security update

Record: RHSA-2016:1547
CVSS 3.0: 6.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-1547 6.5

The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Record: UBUNTU-CVE-2015-1547
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2015-0112 No score

Updated libtiff packages fix security vulnerabilities

The libtiff image decoder library contains several issues that could cause the decoder to crash when reading crafted TIFF images (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130, CVE-2014-9655, CVE-2015-1547).

Record: MGASA-2015-0112
Updated: 2026-11-02

OSVMGASA-2016-0017 No score

Updated libtiff package fixes security vulnerabilities

In libtiff, in tif_next.c, a potential out-of-bound write in NeXTDecode() triggered by the test case for CVE-2015-1547 (maptools bugzilla #2508).

In libtiff, in tif_getimage.c, out-of-bound reads in the TIFFRGBAImage interface in case of unsupported values of SamplesPerPixel/ExtraSamples for LogLUV / CIELab (CVE-2015-8665, CVE-2015-8683).

Record: MGASA-2016-0017
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10554-1 No score

libtiff-devel-32bit-4.0.7-1.1 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10554-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tiff` Debian:12	before 4.0.3-12.1	4.0.3-12.1
`tiff` Debian:13	before 4.0.3-12.1	4.0.3-12.1
`tiff` Debian:14	before 4.0.3-12.1	4.0.3-12.1
`tiff` Debian:6.0	before 3.9.4-5+squeeze12, plus listed versions 3.9.4-53.9.4-5+squeeze13.9.4-5+squeeze103.9.4-5+squeeze113.9.4-5+squeeze2 Show 7 moreShow less 3.9.4-5+squeeze33.9.4-5+squeeze43.9.4-5+squeeze53.9.4-5+squeeze63.9.4-5+squeeze73.9.4-5+squeeze83.9.4-5+squeeze9	3.9.4-5+squeeze12
`tiff3` Debian:7	before 3.9.6-11+deb7u1, plus listed versions 3.9.6-11	3.9.6-11+deb7u1
`tiff` Debian:7	before 4.0.2-6+deb7u4, plus listed versions 4.0.2-64.0.2-6+deb7u14.0.2-6+deb7u24.0.2-6+deb7u3	4.0.2-6+deb7u4
`libtiff` Mageia:4	before 4.0.4-0.1.mga4	4.0.4-0.1.mga4
`libtiff` Mageia:5	before 4.0.6-1.2.mga5	4.0.6-1.2.mga5
`libtiff` Red Hat:enterprise_linux:7::client	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-debuginfo` Red Hat:enterprise_linux:7::client	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`libtiff-devel` Red Hat:enterprise_linux:7::client	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-static` Red Hat:enterprise_linux:7::client	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-tools` Red Hat:enterprise_linux:7::client	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff` Red Hat:enterprise_linux:7::computenode	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-devel` Red Hat:enterprise_linux:7::computenode	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-static` Red Hat:enterprise_linux:7::computenode	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-tools` Red Hat:enterprise_linux:7::computenode	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff` Red Hat:enterprise_linux:7::server	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-debuginfo` Red Hat:enterprise_linux:7::server	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-devel` Red Hat:enterprise_linux:7::server	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-static` Red Hat:enterprise_linux:7::server	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-tools` Red Hat:enterprise_linux:7::server	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff` Red Hat:enterprise_linux:7::workstation	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-devel` Red Hat:enterprise_linux:7::workstation	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-static` Red Hat:enterprise_linux:7::workstation	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff-tools` Red Hat:enterprise_linux:7::workstation	before 0:4.0.3-25.el7_2	0:4.0.3-25.el7_2
`libtiff` Red Hat:enterprise_linux:6::client	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-debuginfo` Red Hat:enterprise_linux:6::client	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-devel` Red Hat:enterprise_linux:6::client	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-static` Red Hat:enterprise_linux:6::client	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff` Red Hat:enterprise_linux:6::computenode	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-devel` Red Hat:enterprise_linux:6::computenode	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-static` Red Hat:enterprise_linux:6::computenode	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff` Red Hat:enterprise_linux:6::server	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-debuginfo` Red Hat:enterprise_linux:6::server	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-devel` Red Hat:enterprise_linux:6::server	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-static` Red Hat:enterprise_linux:6::server	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff` Red Hat:enterprise_linux:6::workstation	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-devel` Red Hat:enterprise_linux:6::workstation	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`libtiff-static` Red Hat:enterprise_linux:6::workstation	before 0:3.9.4-18.el6_8	0:3.9.4-18.el6_8
`tiff` Ubuntu:14.04:LTS	before 4.0.3-7ubuntu0.2, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-74.0.3-7ubuntu0.1	4.0.3-7ubuntu0.2
`tiff` openSUSE:Tumbleweed	before 4.0.7-1.1	4.0.7-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1547 is a medium vulnerability (CVSS 6.5) in Libtiff, published March 22, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. Fixed in tiff 4.0.3-12.1.

References

Show 145 moreShow less