USN-3212-2
tiff regression
USN-3212-1 fixed vulnerabilities in LibTIFF. Unfortunately, some of the security patches were misapplied, which caused a regression when processing certain images. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
What each source reports
OSV No score
tiff regression
USN-3212-1 fixed vulnerabilities in LibTIFF. Unfortunately, some of the security patches were misapplied, which caused a regression when processing certain images. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
- Record
USN-3212-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tiffUbuntu:14.04:LTS |
before 4.0.3-7ubuntu0.7, plus listed versions 4.0.2-4ubuntu34.0.3-5ubuntu14.0.3-64.0.3-6ubuntu14.0.3-7 Show 5 moreShow less4.0.3-7ubuntu0.14.0.3-7ubuntu0.24.0.3-7ubuntu0.34.0.3-7ubuntu0.44.0.3-7ubuntu0.6 |
4.0.3-7ubuntu0.7 |
tiffUbuntu:16.04:LTS |
before 4.0.6-1ubuntu0.2, plus listed versions 4.0.3-12.3ubuntu24.0.5-14.0.6-14.0.6-1ubuntu0.1 |
4.0.6-1ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-3212-2 is a vulnerability with no CVSS score yet in tiff, published May 30, 2017. No source lists public exploit code. Fixed in tiff 4.0.3-7ubuntu0.7.