CVE-2023-3164

2023-11-0200:00:00

ubuntu.com

libtiff

heap buffer overflow

denial of service

tiff file

extractimagesection

tiffcrop.

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

A heap-buffer-overflow vulnerability was found in LibTIFF, in
extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801.
This flaw allows attackers to cause a denial of service via a crafted tiff
file.

Bugs

Notes

Author	Note
	Priority reason: Crash in command line tool only.
sbeattie	buffer overflow in unprivileged tiffcrop CLI tool

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchtiff< 4.0.9-5ubuntu0.10+esm6UNKNOWN
ubuntu20.04noarchtiff< 4.1.0+git191117-2ubuntu0.20.04.13UNKNOWN
ubuntu22.04noarchtiff< 4.3.0-6ubuntu0.9UNKNOWN
ubuntu23.10noarchtiff< 4.5.1+git230720-1ubuntu1.2UNKNOWN
ubuntu24.04noarchtiff< 4.5.1+git230720-4ubuntu2.1UNKNOWN
ubuntu14.04noarchtiff< 4.0.3-7ubuntu0.11+esm13UNKNOWN
ubuntu16.04noarchtiff< 4.0.6-1ubuntu0.8+esm16UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	tiff	< 4.0.9-5ubuntu0.10+esm6	UNKNOWN
ubuntu	20.04	noarch	tiff	< 4.1.0+git191117-2ubuntu0.20.04.13	UNKNOWN
ubuntu	22.04	noarch	tiff	< 4.3.0-6ubuntu0.9	UNKNOWN
ubuntu	23.10	noarch	tiff	< 4.5.1+git230720-1ubuntu1.2	UNKNOWN
ubuntu	24.04	noarch	tiff	< 4.5.1+git230720-4ubuntu2.1	UNKNOWN
ubuntu	14.04	noarch	tiff	< 4.0.3-7ubuntu0.11+esm13	UNKNOWN
ubuntu	16.04	noarch	tiff	< 4.0.6-1ubuntu0.8+esm16	UNKNOWN