{"id":"CVE-2019-14973","aliases":["ALPINE-CVE-2019-14973","BELL-CVE-2019-14973","DEBIAN-CVE-2019-14973","DLA-1897-1","DSA-4608-1","DSA-4670-1","EUVD-2019-6063","GHSA-2586-jx35-m7r7","JLSEC-2025-253","RHSA-2020:1688","RHSA-2020:3902","SUSE-SU-2019:3058-1","SUSE-SU-2020:2744-1","UBUNTU-CVE-2019-14973","USN-4158-1","USN-5841-1","openSUSE-SU-2020:1561-1","openSUSE-SU-2020:1840-1","openSUSE-SU-2024:13381-1"],"status":"published","title":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer...","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04204,"percentile":0.91034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2019-08-14T05:15:29Z","modified":"2026-10-24T10:31:06Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"tiff","fixed_in":["4.0.10-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.0.10+git190814-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.0.10+git190814-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.0.10+git190814-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"tiff","fixed_in":["4.0.3-12.3+deb8u9"],"sources":["osv"]},{"ecosystem":"Julia","package":"Libtiff_jll","fixed_in":["4.1.0+0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debuginfo","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debugsource","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-devel","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-tools-debuginfo","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debuginfo","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debugsource","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools-debuginfo","fixed_in":["0:4.0.9-17.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"tiff","fixed_in":["4.0.9-5.30.28"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","fixed_in":["4.0.3-7ubuntu0.11+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tiff","fixed_in":["4.0.6-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tiff","fixed_in":["4.0.9-5ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tiff","fixed_in":["4.0.9-lp152.11.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tiff","fixed_in":["4.0.9-lp151.10.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10+git190814-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10+git190814-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.10+git190814-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-12.3+deb8u9"}]}],"versions":["4.0.3-12.3","4.0.3-12.3+deb8u1","4.0.3-12.3+deb8u2","4.0.3-12.3+deb8u3","4.0.3-12.3+deb8u4","4.0.3-12.3+deb8u5","4.0.3-12.3+deb8u6","4.0.3-12.3+deb8u7","4.0.3-12.3+deb8u8"]},{"source":"osv","ecosystem":"Debian:10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0+git191117-2~deb10u1"}]}],"versions":["4.0.10+git190814-1","4.0.10+git190818-1","4.0.10+git190903-1","4.0.10+git191003-1","4.0.10-4","4.1.0+git191117-1","4.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-2+deb9u5"}]}],"versions":["4.0.8-2","4.0.8-2+deb9u1","4.0.8-2+deb9u2","4.0.8-2+deb9u3","4.0.8-2+deb9u4"],"bundled":7},{"source":"osv","ecosystem":"Julia","package":"Libtiff_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.0+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-17.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-35.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.42.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5.30.28"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.11+esm6"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.7"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5ubuntu0.3"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.7"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5ubuntu0.3"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.11+esm6"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.8+esm9"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-lp152.11.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-lp151.10.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-2.1"}]}],"bundled":16}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libtiff","product":"libtiff"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://gitlab.com/libtiff/libtiff/merge_requests/90","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Nov/5","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2020/Jan/32","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4608","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4670","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14973","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/"},{"url":"https://github.com/advisories/GHSA-2586-jx35-m7r7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14973","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-14973","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14973","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1688","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1745951","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1688.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14973","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3902","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765705","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3902.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17546","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1108606","tags":["report"]},{"url":"https://bugzilla.suse.com/1121626","tags":["report"]},{"url":"https://bugzilla.suse.com/1125113","tags":["report"]},{"url":"https://bugzilla.suse.com/1146608","tags":["report"]},{"url":"https://bugzilla.suse.com/983268","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7663","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202744-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14973","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4158-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5841-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48281","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4EXJABMPMN6UJVDGJ3YM4HVDIRMDCEJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OVMZRAMTY6Q4MZMMBZQV6ARN5G262VRR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34266","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T05:15:29Z","modified":"2024-08-05T00:34:53.02Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-6063","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T05:15:29Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.624691Z"}],"ghsa":[{"id":"GHSA-2586-jx35-m7r7","title":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer...","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2022-05-24T16:53:35Z","modified":"2023-03-10T05:06:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:54:18.225969Z"}],"nvd":[{"id":"CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T06:15:10.303Z","modified":"2026-06-17T02:19:25.607Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"ALPINE-CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T06:15:10.303Z","modified":"2026-09-21T06:17:52.489851968Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-14973","title":"CVE-2019-14973 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:19.384021Z","modified":"2026-09-06T07:15:09.33326603Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T06:15:10.303Z","modified":"2026-10-24T10:31:06.765020583Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T06:15:10.303Z","modified":"2026-09-21T07:02:02.873201886Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"JLSEC-2025-253","title":"`_TIFFCheckMalloc` and `_TIFFCheckRealloc` in `tif_aux.c` in LibTIFF through 4.0.10 mishandle...","description":"`_TIFFCheckMalloc` and `_TIFFCheckRealloc` in `tif_aux.c` in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2025-11-25T22:18:43.603Z","modified":"2026-07-23T22:30:24.37107097Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2020:1688","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2024-09-16T03:20:52Z","modified":"2026-06-26T12:21:10.073158718Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3902","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2024-09-16T03:47:13Z","modified":"2026-06-27T10:11:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-14973","description":"_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.","status":"published","published":"2019-08-14T06:15:00Z","modified":"2026-04-22T12:11:52.554208Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1897-1","title":"tiff - security update","status":"published","published":"2019-08-25T00:00:00Z","modified":"2026-03-09T01:21:41.626945Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4608-1","title":"tiff - security update","status":"published","published":"2020-01-21T00:00:00Z","modified":"2026-03-09T02:08:50.02078Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"DSA-4670-1","title":"tiff - security update","status":"published","published":"2020-04-29T00:00:00Z","modified":"2026-03-09T02:09:57.878036Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:1561-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2019-14973: Fixed an improper check which was depended on the compiler\n  which could have led to integer overflow (bsc#1146608).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-28T08:21:53Z","modified":"2026-02-04T03:25:49.565503Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1840-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2019-14973: Fixed an improper check which was depended on the compiler\n  which could have led to integer overflow (bsc#1146608).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-05T19:25:43Z","modified":"2026-02-04T04:23:36.036294Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:13381-1","title":"libtiff-devel-32bit-4.6.0-2.1 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.6.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:05.880733Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2019:3058-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14973: Fixed an improper check which was depended on the compiler\n  which could have led to integer overflow (bsc#1146608).\n- CVE-2016-5102: Fixed a buffer overflow in readgifimage() (bsc#983268)\n- CVE-2018-17000: Fixed a NULL pointer dereference in the _TIFFmemcmp function (bsc#1108606).\n- CVE-2019-6128: Fixed a memory leak in the TIFFFdOpen function in tif_unix.c (bsc#1121626).\n- CVE-2019-7663: Fixed an invalid address dereference in the\n  TIFFWriteDirectoryTagTransfer function in libtiff/tif_dirwrite.c (bsc#1125113)\n","status":"published","published":"2019-11-25T16:32:56Z","modified":"2026-02-04T02:21:43.888507Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:2744-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2019-14973: Fixed an improper check which was depended on the compiler\n  which could have led to integer overflow (bsc#1146608).\n","status":"published","published":"2020-09-24T15:56:57Z","modified":"2026-02-04T04:34:46.537393Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4158-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a specially\ncrafted image, a remote attacker could crash the application, leading to a\ndenial of service, or possibly execute arbitrary code with user privileges.\n","status":"published","published":"2019-10-17T12:05:11Z","modified":"2026-04-27T15:33:04.399032905Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-5841-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain malformed\nimages. If a user or automated system were tricked into opening a\nspecially crafted image, a remote attacker could crash the application,\nleading to a denial of service, or possibly execute arbitrary code with\nuser privileges. This issue was only fixed in Ubuntu 14.04 ESM.\n(CVE-2019-14973, CVE-2019-17546, CVE-2020-35523, CVE-2020-35524,\nCVE-2022-3970)\n\nIt was discovered that LibTIFF was incorrectly acessing a data structure\nwhen processing data with the tiffcrop tool, which could lead to a heap\nbuffer overflow. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2022-48281)\n","status":"published","published":"2023-02-02T16:34:35Z","modified":"2026-06-29T13:50:45.812464647Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}