{"id":"CVE-2013-4232","aliases":["DEBIAN-CVE-2013-4232","DSA-2744-1","EUVD-2013-4136","GHSA-m5m4-9rh8-rjhp","MGASA-2013-0258","RHSA-2014:0222","RHSA-2014:0223","UBUNTU-CVE-2013-4232","USN-2205-1","openSUSE-SU-2024:10554-1"],"status":"published","title":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in...","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05019,"percentile":0.92307,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2013-08-22T18:20:56Z","modified":"2026-09-01T20:03:17Z","fixes":[{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.0.3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-5+squeeze10"}]}],"versions":["3.9.4-5","3.9.4-5+squeeze1","3.9.4-5+squeeze2","3.9.4-5+squeeze3","3.9.4-5+squeeze4","3.9.4-5+squeeze5","3.9.4-5+squeeze6","3.9.4-5+squeeze7","3.9.4-5+squeeze8","3.9.4-5+squeeze9"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-6+deb7u2"}]}],"versions":["4.0.2-6","4.0.2-6+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:2","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-2.7.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-4.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.4-10.el6_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.2-19.el5_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.1"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-1.1"}]}],"bundled":49}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libtiff","product":"libtiff"}],"references":[{"url":"http://bugzilla.maptools.org/show_bug.cgi?id=2449","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0223.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995975","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"http://www.debian.org/security/2013/dsa-2744","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/54543","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.asmail.be/msg0055359936.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/54628","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/10/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4232","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0222","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0223","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4232","tags":["report"]},{"url":"https://github.com/advisories/GHSA-m5m4-9rh8-rjhp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4232","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0258.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-August/114181.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11035","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=610759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996468","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0222.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2596","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1960","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1961","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1961","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4231","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4232","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4243","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4244","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0223.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4232","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2205-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4244","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9453","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4232","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2013-09-10T19:00:00Z","modified":"2024-08-06T16:38:01.631Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4136","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2013-09-10T19:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.70868Z"}],"ghsa":[{"id":"GHSA-m5m4-9rh8-rjhp","title":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in...","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2022-05-17T02:39:35Z","modified":"2023-02-10T05:06:53Z","updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2013-4232","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2013-09-10T19:55:11.247Z","modified":"2026-06-16T23:56:51.57Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-4232","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2013-09-10T19:55:11Z","modified":"2026-04-16T06:20:39.715798775Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4232","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"published","published":"2013-09-10T19:55:11.247Z","modified":"2026-09-01T20:03:17.540328756Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2744-1","title":"tiff - several","status":"published","published":"2013-08-27T00:00:00Z","modified":"2026-03-09T01:21:12.109768Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0258","title":"Updated libtiff packagess fix multiple security vulnerabilities","description":"Updated libtiff packages fix security vulnerabilities:\n\nPedro Ribeiro discovered a buffer overflow flaw in rgb2ycbcr, a tool to convert\nRGB color, greyscale, or bi-level TIFF images to YCbCr images, and multiple\nbuffer overflow flaws in gif2tiff, a tool to convert GIF images to TIFF. A\nremote attacker could provide a specially-crafted TIFF or GIF file that, when\nprocessed by rgb2ycbcr and gif2tiff respectively, would cause the tool to crash\nor, potentially, execute arbitrary code with the privileges of the user running\nthe tool (CVE-2013-4231)\n\nPedro Ribeiro discovered a use-after-free flaw in the t2p_readwrite_pdf_image()\nfunction in tiff2pdf, a tool for converting a TIFF image to a PDF document. A\nremote attacker could provide a specially-crafted TIFF file that, when processed\nby tiff2pdf, would cause tiff2pdf to crash or, potentially, execute arbitrary\ncode with the privileges of the user running tiff2pdf (CVE-2013-4232).\n","status":"published","published":"2013-08-22T18:20:56Z","modified":"2026-04-16T06:24:38.32816606Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10554-1","title":"libtiff-devel-32bit-4.0.7-1.1 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.0.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:06:36.058128Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2014:0222","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2024-09-15T21:23:42Z","modified":"2026-06-26T10:23:27Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0223","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2024-09-15T21:23:36Z","modified":"2026-06-26T12:21:45.941023676Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-4232","description":"Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted TIFF image.","status":"withdrawn","published":"2013-09-10T00:00:00Z","modified":"2026-02-04T04:01:57.317381Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-2205-1","title":"tiff vulnerabilities","description":"Pedro Ribeiro discovered that LibTIFF incorrectly handled certain\nmalformed images when using the gif2tiff tool. If a user or automated\nsystem were tricked into opening a specially crafted GIF image, a remote\nattacker could crash the application, leading to a denial of service, or\npossibly execute arbitrary code with user privileges. This issue only\naffected Ubuntu 10.04 LTS, Ubunu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10.\n(CVE-2013-4231)\n\nPedro Ribeiro discovered that LibTIFF incorrectly handled certain\nmalformed images when using the tiff2pdf tool. If a user or automated\nsystem were tricked into opening a specially crafted TIFF image, a remote\nattacker could crash the application, leading to a denial of service, or\npossibly execute arbitrary code with user privileges. This issue only\naffected Ubuntu 10.04 LTS, Ubunu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10.\n(CVE-2013-4232)\n\nMurray McAllister discovered that LibTIFF incorrectly handled certain\nmalformed images when using the gif2tiff tool. If a user or automated\nsystem were tricked into opening a specially crafted GIF image, a remote\nattacker could crash the application, leading to a denial of service, or\npossibly execute arbitrary code with user privileges. (CVE-2013-4243)\n\nHuzaifa Sidhpurwala discovered that LibTIFF incorrectly handled certain\nmalformed images when using the gif2tiff tool. If a user or automated\nsystem were tricked into opening a specially crafted GIF image, a remote\nattacker could crash the application, leading to a denial of service, or\npossibly execute arbitrary code with user privileges. This issue only\naffected Ubuntu 10.04 LTS, Ubunu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10.\n(CVE-2013-4244)\n","status":"published","published":"2014-05-06T13:37:31Z","modified":"2026-04-22T08:53:32.69009Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}