Every CVE Search/ Get API key

CVE-2019-7663

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff...

6.5 MediumFix available

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.36%Up 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
CVE-2019-7663
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
CVE-2019-7663
Updated
2026-11-02
EUVDEUVD-2019-17195 No score

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
EUVD-2019-17195
Updated
2026-11-03
GitHub AdvisoriesGHSA-26x4-fg42-26fj 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff...

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
GHSA-26x4-fg42-26fj
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
CVE-2019-7663
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-7663 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
DEBIAN-CVE-2019-7663
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVJLSEC-2025-252 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in...

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
JLSEC-2025-252
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVUBUNTU-CVE-2019-7663 6.5

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

Record
UBUNTU-CVE-2019-7663
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2019-0101 No score

Updated libtiff packages fix security vulnerability

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900. (CVE-2019-7663)

The invertImage() function in tiffcrop.c:9206 allows remote attackers to cause a denial of service (heap buffer overflow) via invert color space.

Record
MGASA-2019-0101
Updated
2026-11-02
OSVopenSUSE-SU-2019:1161-1 No score

Security update for tiff

This update for tiff fixes the following issues:

Security issues fixed:

  • CVE-2018-19210: Fixed a NULL pointer dereference in TIFFWriteDirectorySec function (bsc#1115717).
  • CVE-2018-17000: Fixed a NULL pointer dereference in the _TIFFmemcmp function (bsc#1108606).
  • CVE-2019-6128: Fixed a memory leak in the TIFFFdOpen function in tif_unix.c (bsc#1121626).
  • CVE-2019-7663: Fixed an invalid address dereference in the TIFFWriteDirectoryTagTransfer function in libtiff/tif_dirwrite.c (bsc#1125113)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1161-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11461-1 No score

libtiff-devel-32bit-4.3.0-1.3 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.3.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11461-1
Updated
2026-11-02
OSVSUSE-SU-2019:0786-1 No score

Security update for tiff

This update for tiff fixes the following issues:

Security issues fixed:

  • CVE-2018-19210: Fixed a NULL pointer dereference in TIFFWriteDirectorySec function (bsc#1115717).
  • CVE-2018-17000: Fixed a NULL pointer dereference in the _TIFFmemcmp function (bsc#1108606).
  • CVE-2019-6128: Fixed a memory leak in the TIFFFdOpen function in tif_unix.c (bsc#1121626).
  • CVE-2019-7663: Fixed an invalid address dereference in the TIFFWriteDirectoryTagTransfer function in libtiff/tif_dirwrite.c (bsc#1125113)
Record
SUSE-SU-2019:0786-1
Updated
2026-11-02
OSVSUSE-SU-2019:3058-1 No score

Security update for tiff

This update for tiff fixes the following issues:

Security issues fixed:

  • CVE-2019-14973: Fixed an improper check which was depended on the compiler which could have led to integer overflow (bsc#1146608).
  • CVE-2016-5102: Fixed a buffer overflow in readgifimage() (bsc#983268)
  • CVE-2018-17000: Fixed a NULL pointer dereference in the _TIFFmemcmp function (bsc#1108606).
  • CVE-2019-6128: Fixed a memory leak in the TIFFFdOpen function in tif_unix.c (bsc#1121626).
  • CVE-2019-7663: Fixed an invalid address dereference in the TIFFWriteDirectoryTagTransfer function in libtiff/tif_dirwrite.c (bsc#1125113)
Record
SUSE-SU-2019:3058-1
Updated
2026-11-02
OSVUSN-3906-1 No score

tiff vulnerabilities

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Record
USN-3906-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tiff
Debian:12
 before 4.0.10-4
4.0.10-4
tiff
Debian:13
 before 4.0.10-4
4.0.10-4
tiff
Debian:14
 before 4.0.10-4
4.0.10-4
tiff
Debian:8
From an advisory covering 3 CVEs
 before 4.0.3-12.3+deb8u8, plus listed versions
4.0.3-12.34.0.3-12.3+deb8u14.0.3-12.3+deb8u24.0.3-12.3+deb8u34.0.3-12.3+deb8u44.0.3-12.3+deb8u54.0.3-12.3+deb8u64.0.3-12.3+deb8u7
4.0.3-12.3+deb8u8
tiff
Debian:9
From an advisory covering 7 CVEs
 before 4.0.8-2+deb9u5, plus listed versions
4.0.8-24.0.8-2+deb9u14.0.8-2+deb9u24.0.8-2+deb9u34.0.8-2+deb9u4
4.0.8-2+deb9u5
Libtiff_jll
Julia
 before 4.1.0+0
4.1.0+0
libtiff
Mageia:6
 before 4.0.10-1.git20190219.1.mga6
4.0.10-1.git20190219.1.mga6
tiff
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 4 CVEs
 before 4.0.9-5.27.5
4.0.9-5.27.5
tiff
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 4 CVEs
 before 4.0.9-5.27.5
4.0.9-5.27.5
tiff
SUSE:Linux Enterprise Module for Package Hub 15
From an advisory covering 4 CVEs
 before 4.0.9-5.27.5
4.0.9-5.27.5
Show 40 moreShow less
Affected packages
PackageAffectedFixed
tiff
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 5 CVEs
 before 4.0.9-44.42.1
4.0.9-44.42.1
tiff
Ubuntu:14.04:LTS
 before 4.0.3-7ubuntu0.11, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7
Show 9 moreShow less
4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.10
4.0.3-7ubuntu0.11
gdal
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3
Show 8 moreShow less
1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm21.10.1+dfsg-5ubuntu1+esm3
 None known
tiff
Ubuntu:16.04:LTS
 before 4.0.6-1ubuntu0.6, plus listed versions
4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.24.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.5
4.0.6-1ubuntu0.6
gdal
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3
Show 5 moreShow less
1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm11.11.3+dfsg-3ubuntu0.1~esm2
 None known
qtimageformats-opensource-src
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2-2build15.5.1-2build1
 None known
texmaker
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.4.1-14.4.1-1.1
 None known
tiff
Ubuntu:18.04:LTS
 before 4.0.9-5ubuntu0.2, plus listed versions
4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3
Show 4 moreShow less
4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.1
4.0.9-5ubuntu0.2
qtimageformats-opensource-src
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.9.1-15.9.2-15.9.2-25.9.3-1ubuntu15.9.4-0ubuntu15.9.5-0ubuntu1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1
 None known
texmaker
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1
 None known
qtimageformats-opensource-src
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.12.4-15.12.5-15.12.5-1build15.12.8-0ubuntu1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7
Show 4 moreShow less
5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1
 None known
texmaker
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1
 None known
qtimageformats-opensource-src
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.2-25.15.2-2build15.15.3-1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1
Show 4 moreShow less
5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1
 None known
qtimageformats-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10-25.15.12-15.15.12-1build15.15.12-1build25.15.13-1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1
 None known
qtimageformats-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.15-35.15.15-45.15.17-1
 None known
qtwebengine-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1
 None known
texmaker
Ubuntu:25.10
 All versions, plus listed versions
5.1.3+dfsg-35.1.3+dfsg-3build1
 None known
qtimageformats-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.18-15.15.19-2
 None known
qtwebengine-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7
 None known
texmaker
Ubuntu:26.10
 All versions, plus listed versions
6.0.1+dfsg-3build16.0.1+dfsg-3build2
 None known
qtimageformats-opensource-src
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17-15.15.17-25.15.18-1
 None known
texmaker
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-3build16.0.1+dfsg-36.0.1+dfsg-3build1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1
 None known
tiff
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
 before 4.0.3-7ubuntu0.11, plus listed versions
4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7
Show 9 moreShow less
4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.64.0.3-7ubuntu0.74.0.3-7ubuntu0.84.0.3-7ubuntu0.94.0.3-7ubuntu0.10
4.0.3-7ubuntu0.11
tiff
Ubuntu:16.04:LTS
From an advisory covering 6 CVEs
 before 4.0.6-1ubuntu0.6, plus listed versions
4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.14.0.6-1ubuntu0.24.0.6-1ubuntu0.34.0.6-1ubuntu0.44.0.6-1ubuntu0.5
4.0.6-1ubuntu0.6
tiff
Ubuntu:18.04:LTS
From an advisory covering 6 CVEs
 before 4.0.9-5ubuntu0.2, plus listed versions
4.0.8-54.0.8-64.0.9-14.0.9-24.0.9-3
Show 4 moreShow less
4.0.9-44.0.9-4ubuntu14.0.9-54.0.9-5ubuntu0.1
4.0.9-5ubuntu0.2
tiff
openSUSE:Leap 15.0
From an advisory covering 4 CVEs
 before 4.0.9-lp150.4.16.1
4.0.9-lp150.4.16.1
tiff
openSUSE:Tumbleweed
From an advisory covering 48 CVEs
 before 4.3.0-1.3
4.3.0-1.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-7663 is a medium vulnerability (CVSS 6.5) in Libtiff, published February 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.36%, the 88th percentile. Fixed in tiff 4.0.10-4.

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open