Description
Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.6.1-2 | — |
| Debian 13 | tiff | 3.6.1-2 | — |
| Debian 12 | tiff | 3.6.1-2 | — |
| Debian 3.0 | tiff | 3.5.5-6woody1 | DSA-567-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kdegraphics +1 | 7:3.1.3-3.7 | RHSA-2005:021 |
| RHEL 3 | libtiff +1 | 3.5.7-20.1 | RHSA-2004:577 |
| RHEL 3 | tetex +5 | 1.0.7-67.7 | RHSA-2005:354 |
Advisories 4
- RHSA-2005:354 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:021 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:577 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-567-1 tiff - heap overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200410-11 vendor-advisory
- RHSA-2004:577 vendor-advisory
- MDKSA-2004:109 vendor-advisory
- oval:org.mitre.oval:def:100114 vdb-entry signature
- RHSA-2005:021 vendor-advisory
- 20041013 CESA-2004-006: libtiff mailing-list
- oval:org.mitre.oval:def:8896 vdb-entry signature
- 201072 vendor-advisory
- 101677 vendor-advisory
- SUSE-SA:2004:038 vendor-advisory
- http://scary.beasts.org/security/CESA-2004-006.txt
- CLA-2004:888 vendor-advisory
- MDKSA-2005:052 vendor-advisory
- http://www.kde.org/info/security/advisory-20041209-2.txt
- RHSA-2005:354 vendor-advisory
- 12818 third-party-advisory
- libtiff-library-decoding-bo(17703) vdb-entry
- 11406 vdb-entry
- DSA-567 vendor-advisory
- VU#948752 third-party-advisory