CVE-2023-6228

2023-12-1800:00:00

ubuntu.com

tiffcp utility

heap-based buffer overflow

application crash

libtiff package

vulnerability discovery

command-line tool

low security impact

embedded copies of tiff

libgeotiff

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

Percentile

10.3%

JSON

An issue was found in the tiffcp utility distributed by the libtiff package
where a crafted TIFF file on processing may cause a heap-based buffer
overflow leads to an application crash.

Bugs

<https://gitlab.com/libtiff/libtiff/-/issues/606>

Notes

Author	Note
	Priority reason: Crash in command-line tool, low security impact
alexmurray	libtk-img and povray both seem to have embedded copies of tiff, whilst libgeotiff appears to duplicate the vulnerable function

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlibgeotiff< anyUNKNOWN
ubuntu22.04noarchlibgeotiff< anyUNKNOWN
ubuntu24.04noarchlibgeotiff< anyUNKNOWN
ubuntu18.04noarchlibtk-img< anyUNKNOWN
ubuntu20.04noarchlibtk-img< anyUNKNOWN
ubuntu22.04noarchlibtk-img< anyUNKNOWN
ubuntu24.04noarchlibtk-img< anyUNKNOWN
ubuntu16.04noarchlibtk-img< anyUNKNOWN
ubuntu18.04noarchpovray< anyUNKNOWN
ubuntu20.04noarchpovray< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	libgeotiff	< any	UNKNOWN
ubuntu	22.04	noarch	libgeotiff	< any	UNKNOWN
ubuntu	24.04	noarch	libgeotiff	< any	UNKNOWN
ubuntu	18.04	noarch	libtk-img	< any	UNKNOWN
ubuntu	20.04	noarch	libtk-img	< any	UNKNOWN
ubuntu	22.04	noarch	libtk-img	< any	UNKNOWN
ubuntu	24.04	noarch	libtk-img	< any	UNKNOWN
ubuntu	16.04	noarch	libtk-img	< any	UNKNOWN
ubuntu	18.04	noarch	povray	< any	UNKNOWN
ubuntu	20.04	noarch	povray	< any	UNKNOWN