{"id":"CVE-2023-52356","aliases":["ALSA-2024:5079","ALSA-2026:7081","AZL-34077","AZL-34955","AZL-43891","AZL-45204","CLSA-2024-1722529534","CLSA-2025-1765546516","DEBIAN-CVE-2023-52356","DLA-3758-1","DLA-4026-1","EUVD-2023-57012","GHSA-cx8g-4cf5-cjv3","MGASA-2024-0055","RHSA-2024:5079","RHSA-2025:20801","RHSA-2026:5958","RHSA-2026:7081","RHSA-2026:7304","RLSA-2024:5079","RLSA-2025:20801","RLSA-2026:7081","ROOT-OS-ALPINE-322-CVE-2023-52356","ROOT-OS-ALPINE-324-CVE-2023-52356","SUSE-SU-2024:0593-1","SUSE-SU-2024:0594-1","SUSE-SU-2025:0753-1","SUSE-SU-2025:20971-1","SUSE-SU-2025:21037-1","UBUNTU-CVE-2023-52356","USN-6644-1","USN-6644-2","openSUSE-SU-2024:13627-1"],"status":"published","title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02721,"percentile":0.86243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2024-01-25T20:03:40Z","modified":"2026-11-07T09:47:34Z","exploits":[{"source":"pocgithub","id":"yardenbenita/CVE-2023-52356-libtiff-analysis","title":"yardenbenita/CVE-2023-52356-libtiff-analysis","date":"2026-09-07","url":"https://github.com/yardenbenita/CVE-2023-52356-libtiff-analysis"}],"fixes":[{"ecosystem":"AlmaLinux:10","package":"libtiff","fixed_in":["4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libtiff-devel","fixed_in":["4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libtiff-tools","fixed_in":["4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libtiff","fixed_in":["4.6.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libtiff","fixed_in":["4.6.0-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff","fixed_in":["4.4.0-13.el9_6.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-devel","fixed_in":["4.4.0-13.el9_6.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-static","fixed_in":["4.4.0-13.el9_6.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-tools","fixed_in":["4.4.0-13.el9_6.2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.5.0-6+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.5.1+git230720-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.5.1+git230720-4"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libtiff","fixed_in":["4.5.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libtiff","fixed_in":["0:4.4.0-13.el9_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libtiff-tools","fixed_in":["0:4.4.0-13.el9_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-debuginfo","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-debugsource","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-devel","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-tools-debuginfo","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-tools","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libtiff","fixed_in":["0:4.6.0-6.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libtiff-tools","fixed_in":["0:4.6.0-6.el10_0.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libtiff","fixed_in":["0:4.6.0-6.el10_1.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tiff","fixed_in":["4.0.9-44.77.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tiff","fixed_in":["4.0.9-44.77.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tiff","fixed_in":["4.0.9-44.77.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tiff","fixed_in":["4.0.9-150000.45.38.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","fixed_in":["4.0.3-7ubuntu0.11+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","fixed_in":["4.0.6-1ubuntu0.8+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","fixed_in":["4.0.9-5ubuntu0.10+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tiff","fixed_in":["4.1.0+git191117-2ubuntu0.20.04.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tiff","fixed_in":["4.3.0-6ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"tiff","fixed_in":["4.5.1+git230720-4ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tiff","fixed_in":["4.6.0-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-35.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-35.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-35.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-35.el7.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-13.el9_6.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-13.el9_6.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-13.el9_6.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-13.el9_6.2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-6+deb12u2"}]}],"versions":["4.5.0-6","4.5.0-6+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1+git230720-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1+git230720-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0+git191117-2~deb10u9"}]}],"versions":["4.0.10+git190814-1","4.0.10+git190818-1","4.0.10+git190903-1","4.0.10+git191003-1","4.0.10-4","4.1.0+git191117-1","4.1.0+git191117-2~deb10u1","4.1.0+git191117-2~deb10u2","4.1.0+git191117-2~deb10u3","4.1.0+git191117-2~deb10u4","4.1.0+git191117-2~deb10u5","4.1.0+git191117-2~deb10u6","4.1.0+git191117-2~deb10u7","4.1.0+git191117-2~deb10u8","4.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1+deb11u6"}]}],"versions":["4.2.0-1","4.2.0-1+deb11u1","4.2.0-1+deb11u2","4.2.0-1+deb11u3","4.2.0-1+deb11u4","4.2.0-1+deb11u5"],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-13.el9_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-13.el9_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libtiff-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_0.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-32.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-15.el9_7.2.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-6.el10_1.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.77.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.77.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.77.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150600.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150600.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-150600.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-slfo.1.1_1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.11+esm12"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5","4.0.3-7ubuntu0.11+esm6","4.0.3-7ubuntu0.11+esm7","4.0.3-7ubuntu0.11+esm8","4.0.3-7ubuntu0.11+esm9","4.0.3-7ubuntu0.11+esm10","4.0.3-7ubuntu0.11+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-3.1ubuntu4","1.9.0-3.1ubuntu6","1.10.1+dfsg-2","1.10.1+dfsg-2build1","1.10.1+dfsg-3","1.10.1+dfsg-3build1","1.10.1+dfsg-3build2","1.10.1+dfsg-3ubuntu1","1.10.1+dfsg-3ubuntu2","1.10.1+dfsg-5ubuntu1","1.10.1+dfsg-5ubuntu1+esm1","1.10.1+dfsg-5ubuntu1+esm2","1.10.1+dfsg-5ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.8+esm15"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8","4.0.6-1ubuntu0.8+esm9","4.0.6-1ubuntu0.8+esm10","4.0.6-1ubuntu0.8+esm11","4.0.6-1ubuntu0.8+esm12","4.0.6-1ubuntu0.8+esm13","4.0.6-1ubuntu0.8+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2+dfsg-3ubuntu3","1.11.2+dfsg-3ubuntu4","1.11.3+dfsg-2build1","1.11.3+dfsg-2build2","1.11.3+dfsg-2build3","1.11.3+dfsg-3","1.11.3+dfsg-3build1","1.11.3+dfsg-3build2","1.11.3+dfsg-3ubuntu0.1~esm1","1.11.3+dfsg-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5ubuntu0.10+esm5"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2","4.0.9-5ubuntu0.3","4.0.9-5ubuntu0.4","4.0.9-5ubuntu0.5","4.0.9-5ubuntu0.6","4.0.9-5ubuntu0.7","4.0.9-5ubuntu0.8","4.0.9-5ubuntu0.9","4.0.9-5ubuntu0.10","4.0.9-5ubuntu0.10+esm1","4.0.9-5ubuntu0.10+esm2","4.0.9-5ubuntu0.10+esm3","4.0.9-5ubuntu0.10+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5-1","5.0.2-1","5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0+git191117-2ubuntu0.20.04.12"}]}],"versions":["4.0.10+git191003-1","4.1.0+git191117-1","4.1.0+git191117-2","4.1.0+git191117-2build1","4.1.0+git191117-2ubuntu0.20.04.1","4.1.0+git191117-2ubuntu0.20.04.2","4.1.0+git191117-2ubuntu0.20.04.3","4.1.0+git191117-2ubuntu0.20.04.4","4.1.0+git191117-2ubuntu0.20.04.5","4.1.0+git191117-2ubuntu0.20.04.6","4.1.0+git191117-2ubuntu0.20.04.7","4.1.0+git191117-2ubuntu0.20.04.8","4.1.0+git191117-2ubuntu0.20.04.9","4.1.0+git191117-2ubuntu0.20.04.10","4.1.0+git191117-2ubuntu0.20.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build2","5.0.3-1build3","5.0.3-1build4","5.0.3-1build5","5.0.3-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-6ubuntu0.8"}]}],"versions":["4.3.0-1","4.3.0-2","4.3.0-3","4.3.0-3build1","4.3.0-4","4.3.0-5","4.3.0-6","4.3.0-6ubuntu0.1","4.3.0-6ubuntu0.2","4.3.0-6ubuntu0.3","4.3.0-6ubuntu0.4","4.3.0-6ubuntu0.5","4.3.0-6ubuntu0.6","4.3.0-6ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build8","5.0.3-1build9","5.0.3-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1+git230720-4ubuntu1"}]}],"versions":["4.5.1+git230720-1ubuntu1","4.5.1+git230720-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-1build4","5.1.3+dfsg-1build5","5.1.3+dfsg-1build6","5.1.3+dfsg-1build7","5.1.3+dfsg-1build8","5.1.3+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-3","5.1.3+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1+dfsg-3build1","6.0.1+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-3build1","6.0.1+dfsg-3","6.0.1+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-7ubuntu0.11+esm12"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5","4.0.3-7ubuntu0.11+esm6","4.0.3-7ubuntu0.11+esm7","4.0.3-7ubuntu0.11+esm8","4.0.3-7ubuntu0.11+esm9","4.0.3-7ubuntu0.11+esm10","4.0.3-7ubuntu0.11+esm11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-1ubuntu0.8+esm15"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8","4.0.6-1ubuntu0.8+esm9","4.0.6-1ubuntu0.8+esm10","4.0.6-1ubuntu0.8+esm11","4.0.6-1ubuntu0.8+esm12","4.0.6-1ubuntu0.8+esm13","4.0.6-1ubuntu0.8+esm14"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-5ubuntu0.10+esm5"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2","4.0.9-5ubuntu0.3","4.0.9-5ubuntu0.4","4.0.9-5ubuntu0.5","4.0.9-5ubuntu0.6","4.0.9-5ubuntu0.7","4.0.9-5ubuntu0.8","4.0.9-5ubuntu0.9","4.0.9-5ubuntu0.10","4.0.9-5ubuntu0.10+esm1","4.0.9-5ubuntu0.10+esm2","4.0.9-5ubuntu0.10+esm3","4.0.9-5ubuntu0.10+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0+git191117-2ubuntu0.20.04.12"}]}],"versions":["4.0.10+git191003-1","4.1.0+git191117-1","4.1.0+git191117-2","4.1.0+git191117-2build1","4.1.0+git191117-2ubuntu0.20.04.1","4.1.0+git191117-2ubuntu0.20.04.2","4.1.0+git191117-2ubuntu0.20.04.3","4.1.0+git191117-2ubuntu0.20.04.4","4.1.0+git191117-2ubuntu0.20.04.5","4.1.0+git191117-2ubuntu0.20.04.6","4.1.0+git191117-2ubuntu0.20.04.7","4.1.0+git191117-2ubuntu0.20.04.8","4.1.0+git191117-2ubuntu0.20.04.9","4.1.0+git191117-2ubuntu0.20.04.10","4.1.0+git191117-2ubuntu0.20.04.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-6ubuntu0.8"}]}],"versions":["4.3.0-1","4.3.0-2","4.3.0-3","4.3.0-3build1","4.3.0-4","4.3.0-5","4.3.0-6","4.3.0-6ubuntu0.1","4.3.0-6ubuntu0.2","4.3.0-6ubuntu0.3","4.3.0-6ubuntu0.4","4.3.0-6ubuntu0.5","4.3.0-6ubuntu0.6","4.3.0-6ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-4.1"}]}]}],"products":[{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"tvos"},{"vendor":"apple","product":"visionos"},{"vendor":"apple","product":"watchos"},{"vendor":"debian","product":"debian_linux"},{"vendor":"libtiff","product":"libtiff"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"ai_inference_server"},{"vendor":"redhat","product":"codeready_linux_builder"},{"vendor":"redhat","product":"codeready_linux_builder_eus"},{"vendor":"redhat","product":"discovery"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:5079","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:20801","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21994","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23078","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23079","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23080","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3461","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3462","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5958","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7081","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7304","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7335","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52356","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.com/libtiff/libtiff/-/issues/622","tags":["x_transferred","Exploit","Issue Tracking","Patch","report","article"]},{"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546","tags":["x_transferred","Issue Tracking","Patch","fix","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214123","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214122","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214117","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214116","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214124","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/16","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/23","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/21","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/17","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/22","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52356","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cx8g-4cf5-cjv3"},{"url":"https://access.redhat.com/security/cve/CVE-2018-15209","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25433","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6228","tags":["report"]},{"url":"https://bugzilla.redhat.com/1614051","tags":["report"]},{"url":"https://bugzilla.redhat.com/2218744","tags":["report"]},{"url":"https://bugzilla.redhat.com/2240995","tags":["report"]},{"url":"https://bugzilla.redhat.com/2251344","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5079.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7081.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1722529534.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2025-1765546516.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52356.json","tags":["advisory"]},{"url":"https://gitlab.com/libtiff/libtiff","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-52356","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0055.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32959","tags":["report"]},{"url":"https://lwn.net/Articles/965011/","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52356","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1614051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240995","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5079.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15209","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6228","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25433","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251326","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20801.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52355","tags":["advisory"]},{"url":"https://gitlab.com/libtiff/libtiff/-/issues/621","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5958.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7081.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7304.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5079","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:20801","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7081","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240593-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219213","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52356","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240594-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250753-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212607","tags":["report"]},{"url":"https://bugzilla.suse.com/1236834","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25435","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520971-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228924","tags":["report"]},{"url":"https://bugzilla.suse.com/1243503","tags":["report"]},{"url":"https://bugzilla.suse.com/1247106","tags":["report"]},{"url":"https://bugzilla.suse.com/1247108","tags":["report"]},{"url":"https://bugzilla.suse.com/1247581","tags":["report"]},{"url":"https://bugzilla.suse.com/1247582","tags":["report"]},{"url":"https://bugzilla.suse.com/1248117","tags":["report"]},{"url":"https://bugzilla.suse.com/1248330","tags":["report"]},{"url":"https://bugzilla.suse.com/1250413","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9900","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521037-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52356","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6644-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6644-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6277","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-52356","title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:03:40.971Z","modified":"2026-11-07T06:16:47.321Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-07T07:33:04.747512Z"}],"euvd":[{"id":"EUVD-2023-57012","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:03:40Z","modified":"2026-11-07T06:16:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T07:08:38.556533Z"}],"ghsa":[{"id":"GHSA-cx8g-4cf5-cjv3","title":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted...","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T21:32:14Z","modified":"2026-06-10T18:31:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:08:43.963781Z"}],"nvd":[{"id":"CVE-2023-52356","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39.063Z","modified":"2026-11-07T07:17:01.043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-07T12:05:05.609476Z"}],"osv":[{"id":"AZL-34077","title":"CVE-2023-52356 affecting package libtiff for versions less than 4.6.0-2","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39Z","modified":"2026-04-21T04:27:01.694727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34955","title":"CVE-2023-52356 affecting package libtiff for versions less than 4.6.0-2","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"AZL-43891","title":"CVE-2023-52356 affecting package openjpeg2 2.3.1-12","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39Z","modified":"2026-04-21T04:31:12.580728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45204","title":"CVE-2023-52356 affecting package openjpeg2 2.3.1-12","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2023-52356","title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:03:40.971Z","modified":"2026-11-08T02:31:00.906515352Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-08T02:57:52.845133Z"},{"id":"DEBIAN-CVE-2023-52356","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:39.063Z","modified":"2026-11-07T09:47:34.368229031Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"RHSA-2024:5079","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2024-09-16T20:04:37Z","modified":"2026-07-03T10:05:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2025:20801","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2025-11-12T10:28:02Z","modified":"2026-10-02T10:05:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2026:5958","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2026-03-27T10:14:44Z","modified":"2026-07-03T10:15:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:7081","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2026-04-09T10:11:51Z","modified":"2026-07-03T10:15:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7304","title":"Red Hat Security Advisory: libtiff security update","status":"published","published":"2026-04-10T10:09:11Z","modified":"2026-07-03T10:15:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2025:20801","title":"Moderate: libtiff security update","description":"The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)\n\n* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2026-05-21T16:27:07.11942Z","modified":"2026-05-21T17:00:03.88112981Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2026:7081","title":"Moderate: libtiff security update","description":"The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-10T12:07:15.128312Z","modified":"2026-04-10T12:30:07.624532Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2023-52356","title":"CVE-2023-52356 in tiff - Patched by Root","description":"Root has patched CVE-2023-52356 in the tiff package for Root:Alpine:3.22. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:31:40Z","modified":"2026-10-09T13:00:07.545563192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-324-CVE-2023-52356","title":"CVE-2023-52356 in tiff - Patched by Root","description":"Root has patched CVE-2023-52356 in the tiff package for Root:Alpine:3.24. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:25:56Z","modified":"2026-10-09T13:00:07.519727004Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"UBUNTU-CVE-2023-52356","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","status":"published","published":"2024-01-25T20:15:00Z","modified":"2026-10-17T12:57:22.821808261Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"ALSA-2024:5079","title":"Moderate: libtiff security update","description":"The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)\n* libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)\n* libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)\n* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-07T00:00:00Z","modified":"2026-10-29T11:02:21.589747004Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2026:7081","title":"Moderate: libtiff security update","description":"The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  \n\nSecurity Fix(es):  \n\n  * libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-10-29T11:58:17.546568Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2024-1722529534","title":"libtiff: Fix of 2 CVEs","description":"- CVE-2023-52356: added proper validation and boundary checks to prevent\n  the SEGV and potential heap-buffer overflow\n- CVE-2023-52355: added functionality to set a maximum possible allocation size\n  in bytes in order to prevent out-of-memory issues when opening a TIFF file and\n  added memory limit option in tools","status":"published","published":"2024-08-01T16:25:37Z","modified":"2026-10-21T10:47:53.715018905Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2025-1765546516","title":"libtiff: Fix of CVE-2023-52356","description":"- CVE-2023-52356: add col/row validation in TIFFReadRGBAStrip/TIFFReadRGBATile to prevent\n  heap-buffer overflow and potential DoS","status":"published","published":"2025-12-12T13:35:19Z","modified":"2026-06-01T00:32:37.026401179Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"DLA-3758-1","title":"tiff - security update","status":"published","published":"2024-03-11T00:00:00Z","modified":"2026-03-09T01:22:35.019025Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4026-1","title":"tiff - security update","status":"published","published":"2025-01-20T00:00:00Z","modified":"2026-03-09T01:23:11.444155Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0055","title":"Updated libtiff packages fix security vulnerability","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered\nby passing a crafted tiff file to the TIFFReadRGBATileExt() API.\nThis flaw allows a remote attacker to cause a heap-buffer overflow,\nleading to a denial of service. (CVE-2023-52356)\n","status":"published","published":"2024-03-12T00:30:17Z","modified":"2026-05-30T05:15:04.44098397Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13627-1","title":"libtiff-devel-32bit-4.6.0-4.1 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.6.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:32.470101Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:5079","title":"Moderate: libtiff security update","description":"The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)\n\n* libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)\n\n* libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)\n\n* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-21T14:52:31.100489Z","modified":"2026-02-04T22:00:09.927019Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:0593-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2023-52356: Fixed segfault in TIFFReadRGBATileExt() (bsc#1219213).\n","status":"published","published":"2024-02-22T14:56:50Z","modified":"2026-02-04T03:05:18.380069Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0594-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2023-52356: Fixed segfault in TIFFReadRGBATileExt() (bsc#1219213).\n","status":"published","published":"2024-02-22T14:58:01Z","modified":"2026-02-04T02:38:03.774131Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2025:0753-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- CVE-2023-25435: Heap-buffer-overflow in extractContigSamplesShifted8bits() in tiffcrop.c (bsc#1212607).\n- CVE-2023-52356: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (bsc#1219213).\n\n\nOther bugfixes:\n\n- Fixed tiff build issue on s390x as test 12 test_directory fails (bsc#1236834).\n","status":"published","published":"2025-02-28T16:30:36Z","modified":"2026-02-04T03:25:43.352583Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20971-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\n- Update to 4.7.1:\n  Security:\n  * CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow() when processing malformed TIFF files (bsc#1247106)\n  * CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)\n  * CVE-2024-13978: libtiff: Fixed LibTIFF Null Pointer Dereference (bsc#1247581)\n  * CVE-2025-8534: Fixed null pointer dereference in function PS_Lvl2page (bsc#1247582)\n  * CVE-2025-8961: Fixed segmentation fault via main function of tiffcrop utility (bsc#1248117)\n  * CVE-2025-9165: libtiff: Fixed local execution manipulation leading to memory leak (bsc#1248330)\n  * CVE-2025-9900: libtiff: Fixed Write-What-Where via TIFFReadRGBAImageOriented (bsc#1250413)\n  Software configuration changes:\n  * Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.\n  * CMake: define WORDS_BIGENDIAN via tif_config.h\n  * doc/CMakeLists.txt: remove useless cmake_minimum_required()\n  * CMake: fix build with LLVM/Clang 17 (fixes issue #651)\n  * CMake: set CMP0074 new policy\n  * Set LINKER_LANGUAGE for C targets with C deps\n  * Export tiffxx cmake target (fixes issue #674)\n  * autogen.sh: Enable verbose wget.\n  * configure.ac: Syntax updates for Autoconf 2.71\n  * autogen.sh: Re-implement based on autoreconf. Failure to update\n    config.guess/config.sub does not return error (fixes issue #672)\n  * CMake: fix CMake 4.0 warning when minimum required version is \u003c 3.10.\n  * CMake: Add build option tiff-static (fixes issue #709)\n  Library changes:\n  * Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control\n    about emitting warnings for unknown tags. No longer emit warnings\n    about unknown tags by default\n  * tif_predict.c: speed-up decompression in some cases.\n  Bug fixes:\n  * tif_fax3: For fax group 3 data if no EOL is detected, reading is\n    retried without synchronisation for EOLs. (fixes issue #54)\n  * Updating TIFFMergeFieldInfo() with read_count=write_count=0 for\n    FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for\n    FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)\n  * tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in\n    the DNG 1.7 specification\n  * TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags\n    defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)\n  * Do not error out on a tag whose tag count value is zero, just issue a warning.\n    Fix parsing a private tag 0x80a6 (fixes issue #647)\n  * TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 \n  * tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)\n  * Fix writing a Predictor=3 file with non-native endianness\n  * _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds\n  * read / nullptr dereference) in case of out-of-memory situation when dealing with\n    custom tags (fixes issue #663)\n  * tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and\n    PlanarConfiguration = Contiguous (fixes issue #26)\n  * tif_fax3.c: error out after a number of times end-of-line or unexpected bad code\n    words have been reached. (fixes issue #670)\n  * Fix memory leak in TIFFSetupStrips() (fixes issue #665)\n  * tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with\n    -DZ_SOLO inflating will fail.\n  * Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)\n  * tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if \"prediction\"\n    is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)\n  * tif_getimage.c: update some integer overflow checks (fixes issue #79)\n  * TIFFReadRGBAImage(): several fixes to avoid buffer overflows.\n  * Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative()\n    if HAVE_IEEEFP is not defined. (fixes issue #699)\n  * LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker\n    has been found with remaining output bytes (fixes issue #698)\n  * TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.\n  * TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing\n    tif_rawdata (fixes issue #711)\n  * JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid\n    out-of-bounds access (fixes issue #714)\n  * tif_jpeg: Fix bug in JPEGDecodeRaw() if JPEG_LIB_MK1_OR_12BIT is defined for 8/12bit\n    dual mode, introduced in libjpeg-turbo 2.2, which was actually released as 3.0.\n    Fixes issue #717\n  * add assert for TIFFReadCustomDirectory infoarray check.\n  * ppm2tiff: Fix bug in pack_words trailing bytes, where last two bytes of each line\n    were written wrongly. (fixes issue #467)\n  * fax2ps: fix regression of commit 28c38d648b64a66c3218778c4745225fe3e3a06d where\n    TIFFTAG_FAXFILLFUNC is being used rather than an output buffer (fixes issue #649)\n  * tiff2pdf: Check TIFFTAG_TILELENGTH and TIFFTAGTILEWIDTH (fixes issue #650)\n  * tiff2pdf: check h_samp and v_samp for range 1 to 4 to avoid division by zero.\n    Fixes issue #654\n  * tiff2pdf: avoid null pointer dereference. (fixes issue #741)\n  * Improve non-secure integer overflow check (comparison of division result with\n    multiplicant) at compiler optimisation in tiffcp, rgb2ycbcr and tiff2rgba.\n    Fixes issue #546\n  * tiff2rgba: fix some \"a partial expression can generate an overflow before it is\n    assigned to a broader type\" warnings. (fixes issue #682)\n  * tiffdither/tiffmedian: Don't skip the first line of the input image. (fixes issue #703)\n  * tiffdither: avoid out-of-bounds read identified in issue #733\n  * tiffmedian: error out if TIFFReadScanline() fails (fixes issue #707)\n  * tiffmedian: close input file. (fixes issue #735)\n  * thumbail: avoid potential out of bounds access (fixes issue #715)\n  * tiffcrop: close open TIFF files and release allocated buffers before exiting in case\n    of error to avoid memory leaks. (fixes issue #716)\n  * tiffcrop: fix double-free and memory leak exposed by issue #721\n  * tiffcrop: avoid buffer overflow. (fixes issue #740)\n  * tiffcrop: avoid nullptr dereference. (fixes issue #734)\n  * tiffdump: Fix coverity scan issue CID 1373365: Passing tainted expression *datamem\n    to PrintData, which uses it as a divisor or modulus.\n  * tiff2ps: check return of TIFFGetFiled() for TIFFTAG_STRIPBYTECOUNTS and\n    TIFFTAG_TILEBYTECOUNTS to avoid NULL pointer dereference. (fixes issue #718)\n  * tiffcmp: fix memory leak when second file cannot be opened. (fixes issue #718 and issue #729)\n  * tiffcp: fix setting compression level for lossless codecs. (fixes issue #730)\n  * raw2tiff: close input file before exit (fixes issue #742)\n  Tools changes:\n  * tiffinfo: add a -W switch to warn about unknown tags.\n  * tiffdither: process all pages in input TIFF file.\n  Documentation:\n  * TIFFRGBAImage.rst note added for incorrect saving of images with TIFF orientation\n    from 5 (LeftTop) to 8 (LeftBottom) in the raster.\n  * TIFFRGBAImage.rst note added about un-associated alpha handling (fixes issue #67)\n  * Update \"Defining New TIFF Tags\" description. (fixes issue #642)\n  * Fix return type of TIFFReadEncodedTile()\n  * Update the documentation to reflect deprecated typedefs.\n  * TIFFWriteDirectory.rst: Clarify TIFFSetWriteOffset() only sets offset for image\n    data and not for IFD data.\n  * Update documentation on re-entrancy and thread safety.\n  * Remove dead links to no more existing Awaresystems web-site.\n  * Updating BigTIFF specification and some miscelaneous editions.\n  * Replace some last links and remove last todos.\n  * Added hints for correct allocation of TIFFYCbCrtoRGB structure and its\n    associated buffers. (fixes issue #681)\n  * Added chapter to \"Using the TIFF Library\" with links to handling multi-page TIFF\n    and custom directories. (fixes issue #43)\n  * update TIFFOpen.rst with the return values of mapproc and unmapproc. (fixes issue #12)\n\n- Fix TIFFMergeFieldInfo() read_count=write_count=0 (bsc#1243503)\n- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4\n- Add %check section\n- Remove Group: declarations, no longer used\n- Use python3-Sphinx instead of  %{primary_python}-Sphinx\n  based on recommendation from python maintainers.\n  * Fixes build issue of man flavor on 15.6\n- Update test/test_directory.c not to fail on big-endian machines (bsc#1236834).\n- Fix versioning of tiff-docs under Recommends\n\n- Update to 4.7.0:\n  * This version restores in the default build the availability of\n    the tools that had been dropped in v4.6.0\n  * Software configuration changes:\n    + autoconf build: configure.ac: avoid -Werror passed to CFLAGS to interfere with feature detection\n    + autoconf build: fix error when running make clean (fixes issue #630)\n    + autoconf build: back off the minimum required automake version to 1.11\n    + autoconf.ac: fix detection of windows.h for mingw (fixes issue #605)\n    + libtiff-4.pc: Fix Requires.private missing Lerc. It provides a .pc file\n      starting from version 4 (in autoconf builds, we assume that liblerc is at least version 4)\n    + CMake: Fix TIFF_INCLUDE_DIRS\n    + CMake: MinGW compilers don't need a .def file for shared library\n    + CMake: move libdeflate and Lerc to Requires.private\n    + CMake: enable resource compilation on all Windows.\n  * Library changes:\n    + Add TIFFOpenOptionsSetMaxCumulatedMemAlloc(). This function complements\n      TIFFOpenOptionsSetMaxSingleMemAlloc() to define the maximum cumulated memory\n      allocations in byte, for a given TIFF handle, that libtiff internal memory\n      allocation functions are allowed. \n    + TIFFWriteDirectory(): Avoid overwriting following data if an IFD is enlarged.\n    + TIFFXYZToRGB: avoid integer overflow (fixes issue #644)\n    + uv_decode() and uv_encode(): avoid potential out-of-bounds array index (fixes issue #645)\n    + Fix cases where tif_curdir is set incorrectly. Fix cases where the current directory number (tif_curdir)\n      is set inconsistently or incorrectly, depending on the previous history.\n    + TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize output buffer if setupdecode fails ;\n      most codecs: zero-initialize (not-yet-written parts of) output buffer if failure (fixes issue #375)\n    + OJPEG: reset subsampling_convert_state=0 in OJPEGPreDecode (fixes issue #183)\n    + ThunderRLE: fix failure when decoding last run. Bug seen with GhostPDL\n    + LERC codec: deal with issues with multi-band PlanarConfig=Contig and NaN values\n    + tif_fax3.c: error out after a number of times end-of-file has been reached (fixes issue #583)\n    + LZW: avoid warning about misaligned address with UBSAN (fixes issue #616)\n    + CVE-2023-52356: Fixed segment fault in TIFFReadRGBATileExt() leading to denial of service (bsc#1219213)\n    + tif_dirread.c: only issue TIFFGetFileSize() for large enough RAM requests\n    + Avoid FPEs (division by zero) in tif_getimage.c.\n    + Avoiding FPE (division by zero) for TIFFhowmany_32() and TIFFhowmany_64() macros by checking for\n      denominator not zero before macros are executed. (fixes issue #628)\n    + Add non-zero check before division in TIFFComputeStrip()\n    + Fix wrong return of TIFFIsBigTIFF() in case byte-swapping is active\n    + Setting the TIFFFieldInfo field set_field_type should consider field_writecount not field_readcount\n    + Avoid memory leaks when using TIFFCreateDirectory() by releasing the allocated memory in the tif-structure.\n    + For non-terminated ASCII arrays, the buffer is first enlarged before a NULL is set at the end to\n      avoid deleting the last character. (fixes issue #579)\n    + CVE-2024-7006: Fixed NULL pointer dereference in tif_dirinfo.c (bsc#1228924)\n    + Prevent some out-of-memory attacks (fixes issue #614)\n    + Ensure absolute seeking is forced independent of TIFFReadDirectory success. (fixes issue #618)\n    + tif_dirinfo.c: re-enable TIFFTAG_EP_CFAREPEATPATTERNDIM and TIFFTAG_EP_CFAPATTERN tags (fixes issue #608)\n    + Fix warnings with GCC 14\n    + tif_dir.c: Log source file, line number, and input tif for directory count error (fixes issue #627)\n    + Last usage of get_field_type of TIFFField structure at TIFFWriteDirectorySec() changed to using set_field_type.\n    + tif_jpeg.c/tif_ojpeg.c: remove likely ifdef tricks related to old compilers or unusual setups\n    + Remove _TIFFUInt64ToFloat() and _TIFFUInt64ToDouble()\n    + Remove support for _MSC_VER \u003c 1500.\n    + Use #ifdef _WIN32 to test for Windows, and tiffio.h: remove definition of __WIN32__\n  * Documentation:\n    + Amend manpages for changes in current directory index behaviour\n    + Note on using TIFFFlush() before TIFFClose() to check that the data has been successfully written to the file. (fixes issue #506)\n    + Update TIFF documentation about TIFFOpenOptions.rst and TIFFOpenOptionsSetMaxSingleMemAlloc() usage and some other small fixes\n  * Re-added tools:\n    + fax2ps\n    + fax2tiff\n    + pal2rgb\n    + ppm2tiff\n    + raw2tiff\n    + rgb2ycbcr (not installed)\n    + thumbnail (not installed)\n    + tiff2bw\n    + tiff2rgba\n    + tiffcmp\n    + tiffcrop\n    + tiffdither\n    + tiffgt\n    + tiffmedian\n    + tiff2ps\n    + tiff2pdf\n  * New/improved functionality:\n     + tiff2rgba: Add background gradient option for alpha compositing\n     + tiffcp: -i flag restored\n  * Bug fixes for tools:\n    + tiffcrop: address Coverity scan issues 1605444, 1605445, and 16054\n    + tiffcrop: Apply \"Fix heap-buffer-overflow in function extractImageSection\"\n    + tiffcrop: fix buffer overflows, use after free (fixes issue #542, issue #550, issue #552)\n    + tiff2pdf: address Coverity scan issues\n    + tiff2pdf: fix inconsistent PLANARCONFIG value for the input and output TIFF\n    + tiff2pdf: fix issue with JPEG restart-interval marker when converting from JPEG-compressed files (fixes issue #539)\n    + tiff2pdf: red and blue were being swapped for RGBA decoding (fixes issue #253)\n    + tiff2pdf: fixes issue #596\n    + thumbnail: address Coverity scan issues\n    + tiffcp: Add check for limitMalloc return to fix Coverity 1603334\n    + tiffcp: preserve TIFFTAG_REFERENCEBLACKWHITE when doing YCbCr JPEG -\u003e YCbCr JPEG\n    + tiffcp: replace PHOTOMETRIC_YCBCR with PHOTOMETRIC_RGB when outputing to compression != JPEG (refs issue #571)\n    + tiffcp: do not copy tags YCBCRCOEFFICIENTS, YCBCRSUBSAMPLING, YCBCRPOSITIONING, REFERENCEBLACKWHITE. Only set YCBCRSUBSAMPLING when generating YCbCr JPEG\n    + tiffcp: Check also codec of input image, not only from output image (fixes issue #606)\n    + Add some basic sanity checks for tiffcp and tiffcrop RGB-\u003eYCbCr JPEG conversions.\n    + fax2ps and fax2tiff: memory leak fixes (fixes issue #476)\n    + tiffmedian: memory leak fixes (fixes issue #599)\n    + fax2tiff: fix EOFB interpretation (fixes issue #191)\n    + fax2tiff: fix issue with unreasonable width input (fixes issue #249)\n    + tiffcp and tiffcrop: fixes issue #228\n    + tiff2rgba: fixes issue #469\n    + tiffdither: fixes issue #473\n    + tiffdump: fix wrong printf formatter in error message (Coverity 1472932)\n    + tiffset: avoid false positive Coverity Scan warning on 64-bit builds (Coverity 1518997)\n    + tifcp/tiffset: use correct format specifiers\n  * Changes to contributed and unsupported tools\n    + contrib/addtiffo: validate return of TIFFWriteEncodedXXXX() calls (Coverity 1024680)\n- Tools are not built for now due to test failure: `FAIL: tiffcp-32bpp-None-jpeg.sh`\n","status":"published","published":"2025-11-06T11:07:55Z","modified":"2026-03-23T04:51:07.264572Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21037-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\ntiff was updated to 4.7.1:\n\n  Software configuration changes:\n\n  * Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.\n  * CMake: define WORDS_BIGENDIAN via tif_config.h\n  * doc/CMakeLists.txt: remove useless cmake_minimum_required()\n  * CMake: fix build with LLVM/Clang 17 (fixes issue #651)\n  * CMake: set CMP0074 new policy\n  * Set LINKER_LANGUAGE for C targets with C deps\n  * Export tiffxx cmake target (fixes issue #674)\n  * autogen.sh: Enable verbose wget.\n  * configure.ac: Syntax updates for Autoconf 2.71\n  * autogen.sh: Re-implement based on autoreconf. Failure to update\n    config.guess/config.sub does not return error (fixes issue #672)\n  * CMake: fix CMake 4.0 warning when minimum required version is \u003c 3.10.\n  * CMake: Add build option tiff-static (fixes issue #709)\n\n  Library changes:\n\n  * Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control\n    about emitting warnings for unknown tags. No longer emit warnings\n    about unknown tags by default\n  * tif_predict.c: speed-up decompression in some cases.\n\n  Bug fixes:\n\n  * tif_fax3: For fax group 3 data if no EOL is detected, reading is\n    retried without synchronisation for EOLs. (fixes issue #54)\n  * Updating TIFFMergeFieldInfo() with read_count=write_count=0 for\n    FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for\n    FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)\n  * tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in\n    the DNG 1.7 specification\n  * TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags\n    defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)\n  * Do not error out on a tag whose tag count value is zero, just issue a warning.\n    Fix parsing a private tag 0x80a6 (fixes issue #647)\n  * TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 \n    Fixes https://github.com/OSGeo/gdal/issues/10875)\n  * tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)\n  * Fix writing a Predictor=3 file with non-native endianness\n  * _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds\n  * read / nullptr dereference) in case of out-of-memory situation when dealing with\n    custom tags (fixes issue #663)\n  * tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and\n    PlanarConfiguration = Contiguous (fixes issue #26)\n  * tif_fax3.c: error out after a number of times end-of-line or unexpected bad code\n    words have been reached. (fixes issue #670)\n  * Fix memory leak in TIFFSetupStrips() (fixes issue #665)\n  * tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with\n    -DZ_SOLO inflating will fail.\n  * Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)\n  * tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if \"prediction\"\n    is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)\n  * tif_getimage.c: update some integer overflow checks (fixes issue #79)\n  * tif_getimage.c: Fix buffer underflow crash for less raster rows at\n    TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)\n  * TIFFReadRGBAImage(): several fixes to avoid buffer overflows.\n  * Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative()\n    if HAVE_IEEEFP is not defined. (fixes issue #699)\n  * LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker\n    has been found with remaining output bytes (fixes issue #698)\n  * TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.\n  * TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing\n    tif_rawdata (fixes issue #711)\n  * JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid\n    out-of-bounds access (fixes issue #714)\n  * tif_jpeg: Fix bug in JPEGDecodeRaw() if JPEG_LIB_MK1_OR_12BIT is defined for 8/12bit\n    dual mode, introduced in libjpeg-turbo 2.2, which was actually released as 3.0.\n    Fixes issue #717\n  * add assert for TIFFReadCustomDirectory infoarray check.\n  * ppm2tiff: Fix bug in pack_words trailing bytes, where last two bytes of each line\n    were written wrongly. (fixes issue #467)\n  * fax2ps: fix regression of commit 28c38d648b64a66c3218778c4745225fe3e3a06d where\n    TIFFTAG_FAXFILLFUNC is being used rather than an output buffer (fixes issue #649)\n  * tiff2pdf: Check TIFFTAG_TILELENGTH and TIFFTAGTILEWIDTH (fixes issue #650)\n  * tiff2pdf: check h_samp and v_samp for range 1 to 4 to avoid division by zero.\n    Fixes issue #654\n  * tiff2pdf: avoid null pointer dereference. (fixes issue #741)\n  * Improve non-secure integer overflow check (comparison of division result with\n    multiplicant) at compiler optimisation in tiffcp, rgb2ycbcr and tiff2rgba.\n    Fixes issue #546\n  * tiff2rgba: fix some \"a partial expression can generate an overflow before it is\n    assigned to a broader type\" warnings. (fixes issue #682)\n  * tiffdither/tiffmedian: Don't skip the first line of the input image. (fixes issue #703)\n  * tiffdither: avoid out-of-bounds read identified in issue #733\n  * tiffmedian: error out if TIFFReadScanline() fails (fixes issue #707)\n  * tiffmedian: close input file. (fixes issue #735)\n  * thumbail: avoid potential out of bounds access (fixes issue #715)\n  * tiffcrop: close open TIFF files and release allocated buffers before exiting in case\n    of error to avoid memory leaks. (fixes issue #716)\n  * tiffcrop: fix double-free and memory leak exposed by issue #721\n  * tiffcrop: avoid buffer overflow. (fixes issue #740)\n  * tiffcrop: avoid nullptr dereference. (fixes issue #734)\n  * tiffdump: Fix coverity scan issue CID 1373365: Passing tainted expression *datamem\n    to PrintData, which uses it as a divisor or modulus.\n  * tiff2ps: check return of TIFFGetFiled() for TIFFTAG_STRIPBYTECOUNTS and\n    TIFFTAG_TILEBYTECOUNTS to avoid NULL pointer dereference. (fixes issue #718)\n  * tiffcmp: fix memory leak when second file cannot be opened. (fixes issue #718 and issue #729)\n  * tiffcp: fix setting compression level for lossless codecs. (fixes issue #730)\n  * raw2tiff: close input file before exit (fixes issue #742)\n\n  Tools changes:\n\n  * tiffinfo: add a -W switch to warn about unknown tags.\n  * tiffdither: process all pages in input TIFF file.\n\n  Documentation:\n\n  * TIFFRGBAImage.rst note added for incorrect saving of images with TIFF orientation\n    from 5 (LeftTop) to 8 (LeftBottom) in the raster.\n  * TIFFRGBAImage.rst note added about un-associated alpha handling (fixes issue #67)\n  * Update \"Defining New TIFF Tags\" description. (fixes issue #642)\n  * Fix return type of TIFFReadEncodedTile()\n  * Update the documentation to reflect deprecated typedefs.\n  * TIFFWriteDirectory.rst: Clarify TIFFSetWriteOffset() only sets offset for image\n    data and not for IFD data.\n  * Update documentation on re-entrancy and thread safety.\n  * Remove dead links to no more existing Awaresystems web-site.\n  * Updating BigTIFF specification and some miscelaneous editions.\n  * Replace some last links and remove last todos.\n  * Added hints for correct allocation of TIFFYCbCrtoRGB structure and its\n    associated buffers. (fixes issue #681)\n  * Added chapter to \"Using the TIFF Library\" with links to handling multi-page TIFF\n    and custom directories. (fixes issue #43)\n  * update TIFFOpen.rst with the return values of mapproc and unmapproc. (fixes issue #12)\n\n* CVE-2025-8961: Fix segmentation fault via main function of tiffcrop utility [bsc#1248117]\n* CVE-2025-8534: Fix null pointer dereference in function PS_Lvl2page [bsc#1247582]\n* CVE-2025-9165: Fix local execution manipulation can lead to memory leak [bsc#1248330]\n* CVE-2024-13978: Fix null pointer dereference in tiff2pdf [bsc#1247581]\n    \n  Fix TIFFMergeFieldInfo() read_count=write_count=0 (bsc#1243503)\n\n* CVE-2025-8176: Fix heap use-after-free in tools/tiffmedian.c [bsc#1247108]\n* CVE-2025-8177: Fix possible buffer overflow in tools/thumbnail.c:setrow()  [bsc#1247106]\n\n*Fix memory leaks (bsc#1236834)\n\nUpdate to 4.7.0:\n\n  * This version restores in the default build the availability of\n    the tools that had been dropped in v4.6.0\n    See https://libtiff.gitlab.io/libtiff/rfcs/rfc2_restoring_needed_tools.html#rfc2-restoring-needed-tools\n  * Software configuration changes:\n\n    + autoconf build: configure.ac: avoid -Werror passed to CFLAGS to interfere with feature detection\n    + autoconf build: fix error when running make clean (fixes issue #630)\n    + autoconf build: back off the minimum required automake version to 1.11\n    + autoconf.ac: fix detection of windows.h for mingw (fixes issue #605)\n    + libtiff-4.pc: Fix Requires.private missing Lerc. It provides a .pc file\n      starting from version 4 (in autoconf builds, we assume that liblerc is at least version 4)\n    + CMake: Fix TIFF_INCLUDE_DIRS\n    + CMake: MinGW compilers don't need a .def file for shared library\n    + CMake: move libdeflate and Lerc to Requires.private\n    + CMake: enable resource compilation on all Windows.\n\n  * Library changes:\n\n    + Add TIFFOpenOptionsSetMaxCumulatedMemAlloc(). This function complements\n      TIFFOpenOptionsSetMaxSingleMemAlloc() to define the maximum cumulated memory\n      allocations in byte, for a given TIFF handle, that libtiff internal memory\n      allocation functions are allowed. \n    + TIFFWriteDirectory(): Avoid overwriting following data if an IFD is enlarged.\n    + TIFFXYZToRGB: avoid integer overflow (fixes issue #644)\n    + uv_decode() and uv_encode(): avoid potential out-of-bounds array index (fixes issue #645)\n    + Fix cases where tif_curdir is set incorrectly. Fix cases where the current directory number (tif_curdir)\n      is set inconsistently or incorrectly, depending on the previous history.\n    + TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize output buffer if setupdecode fails ;\n      most codecs: zero-initialize (not-yet-written parts of) output buffer if failure (fixes issue #375)\n    + OJPEG: reset subsampling_convert_state=0 in OJPEGPreDecode (fixes issue #183)\n    + ThunderRLE: fix failure when decoding last run. Bug seen with GhostPDL\n    + LERC codec: deal with issues with multi-band PlanarConfig=Contig and NaN values\n    + tif_fax3.c: error out after a number of times end-of-file has been reached (fixes issue #583)\n    + LZW: avoid warning about misaligned address with UBSAN (fixes issue #616)\n    + TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of col/row (fixes issue #622, CVE-2023-52356)\n    + tif_dirread.c: only issue TIFFGetFileSize() for large enough RAM requests\n    + Avoid FPEs (division by zero) in tif_getimage.c.\n    + Avoiding FPE (division by zero) for TIFFhowmany_32() and TIFFhowmany_64() macros by checking for\n      denominator not zero before macros are executed. (fixes issue #628)\n    + Add non-zero check before division in TIFFComputeStrip()\n    + Fix wrong return of TIFFIsBigTIFF() in case byte-swapping is active\n    + Setting the TIFFFieldInfo field set_field_type should consider field_writecount not field_readcount\n    + Avoid memory leaks when using TIFFCreateDirectory() by releasing the allocated memory in the tif-structure.\n    + For non-terminated ASCII arrays, the buffer is first enlarged before a NULL is set at the end to\n      avoid deleting the last character. (fixes issue #579)\n    + Check return value of _TIFFCreateAnonField(). (fixes issue #624, CVE-2024-7006)\n    + Prevent some out-of-memory attacks (https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857)\n    + Ensure absolute seeking is forced independent of TIFFReadDirectory success. (fixes issue #618)\n    + tif_dirinfo.c: re-enable TIFFTAG_EP_CFAREPEATPATTERNDIM and TIFFTAG_EP_CFAPATTERN tags (fixes issue #608)\n    + Fix warnings with GCC 14\n    + tif_dir.c: Log source file, line number, and input tif for directory count error (fixes issue #627)\n    + Last usage of get_field_type of TIFFField structure at TIFFWriteDirectorySec() changed to using set_field_type.\n    + tif_jpeg.c/tif_ojpeg.c: remove likely ifdef tricks related to old compilers or unusual setups\n    + Remove _TIFFUInt64ToFloat() and _TIFFUInt64ToDouble()\n    + Remove support for _MSC_VER \u003c 1500.\n    + Use #ifdef _WIN32 to test for Windows, and tiffio.h: remove definition of __WIN32__\n\n  * Documentation:\n\n    + Amend manpages for changes in current directory index behaviour\n    + Note on using TIFFFlush() before TIFFClose() to check that the data has been successfully written to the file. (fixes issue #506)\n    + Update TIFF documentation about TIFFOpenOptions.rst and TIFFOpenOptionsSetMaxSingleMemAlloc() usage and some other small fixes (relates to CVE-2024-7006)\n\n  * Re-added tools:\n\n    + fax2ps\n    + fax2tiff\n    + pal2rgb\n    + ppm2tiff\n    + raw2tiff\n    + rgb2ycbcr (not installed)\n    + thumbnail (not installed)\n    + tiff2bw\n    + tiff2rgba\n    + tiffcmp\n    + tiffcrop\n    + tiffdither\n    + tiffgt\n    + tiffmedian\n    + tiff2ps\n    + tiff2pdf\n\n  * New/improved functionality:\n\n     + tiff2rgba: Add background gradient option for alpha compositing\n     + tiffcp: -i flag restored\n\n  * Bug fixes for tools:\n\n    + tiffcrop: address Coverity scan issues 1605444, 1605445, and 16054\n    + tiffcrop: Apply \"Fix heap-buffer-overflow in function extractImageSection\"\n    + tiffcrop: fix buffer overflows, use after free (fixes issue #542, issue #550, issue #552)\n    + tiff2pdf: address Coverity scan issues\n    + tiff2pdf: fix inconsistent PLANARCONFIG value for the input and output TIFF\n    + tiff2pdf: fix issue with JPEG restart-interval marker when converting from JPEG-compressed files (fixes issue #539)\n    + tiff2pdf: red and blue were being swapped for RGBA decoding (fixes issue #253)\n    + tiff2pdf: fixes issue #596\n    + thumbnail: address Coverity scan issues\n    + tiffcp: Add check for limitMalloc return to fix Coverity 1603334\n    + tiffcp: preserve TIFFTAG_REFERENCEBLACKWHITE when doing YCbCr JPEG -\u003e YCbCr JPEG\n    + tiffcp: replace PHOTOMETRIC_YCBCR with PHOTOMETRIC_RGB when outputing to compression != JPEG (refs issue #571)\n    + tiffcp: do not copy tags YCBCRCOEFFICIENTS, YCBCRSUBSAMPLING, YCBCRPOSITIONING, REFERENCEBLACKWHITE. Only set YCBCRSUBSAMPLING when generating YCbCr JPEG\n    + tiffcp: Check also codec of input image, not only from output image (fixes issue #606)\n    + Add some basic sanity checks for tiffcp and tiffcrop RGB-\u003eYCbCr JPEG conversions.\n    + fax2ps and fax2tiff: memory leak fixes (fixes issue #476)\n    + tiffmedian: memory leak fixes (fixes issue #599)\n    + fax2tiff: fix EOFB interpretation (fixes issue #191)\n    + fax2tiff: fix issue with unreasonable width input (fixes issue #249)\n    + tiffcp and tiffcrop: fixes issue #228\n    + tiff2rgba: fixes issue #469\n    + tiffdither: fixes issue #473\n    + tiffdump: fix wrong printf formatter in error message (Coverity 1472932)\n    + tiffset: avoid false positive Coverity Scan warning on 64-bit builds (Coverity 1518997)\n    + tifcp/tiffset: use correct format specifiers\n\n\n","status":"published","published":"2025-11-10T14:45:27Z","modified":"2026-03-23T04:50:19.109065Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-6644-1","title":"tiff vulnerabilities","description":"It was discovered that LibTIFF incorrectly handled certain files. If\na user were tricked into opening a specially crafted file, an attacker\ncould possibly use this issue to cause the application to crash, resulting\nin a denial of service. (CVE-2023-52356)\n\nIt was discovered that LibTIFF incorrectly handled certain image files\nwith the tiffcp utility. If a user were tricked into opening a specially\ncrafted image file, an attacker could possibly use this issue to cause\ntiffcp to crash, resulting in a denial of service. (CVE-2023-6228)\n\nIt was discovered that LibTIFF incorrectly handled certain files. If\na user were tricked into opening a specially crafted file, an attacker\ncould possibly use this issue to cause the application to consume\nresources, resulting in a denial of service. (CVE-2023-6277)\n","status":"published","published":"2024-02-19T20:07:28Z","modified":"2026-06-29T13:46:58.147146242Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6644-2","title":"tiff vulnerabilities","description":"USN-6644-1 fixed vulnerabilities in LibTIFF.\nThis update provides the corresponding updates for Ubuntu 22.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that LibTIFF incorrectly handled certain files. If\n a user were tricked into opening a specially crafted file, an attacker\n could possibly use this issue to cause the application to crash, resulting\n in a denial of service. (CVE-2023-52356)\n \n It was discovered that LibTIFF incorrectly handled certain image files\n with the tiffcp utility. If a user were tricked into opening a specially\n crafted image file, an attacker could possibly use this issue to cause\n tiffcp to crash, resulting in a denial of service. (CVE-2023-6228)\n \n It was discovered that LibTIFF incorrectly handled certain files. If\n a user were tricked into opening a specially crafted file, an attacker\n could possibly use this issue to cause the application to consume\n resources, resulting in a denial of service. (CVE-2023-6277)\n","status":"published","published":"2024-02-27T18:31:07Z","modified":"2026-04-27T17:17:25.091683549Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}