Description
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.8.2-4 | — |
| Debian 13 | tiff | 3.8.2-4 | — |
| Debian 12 | tiff | 3.8.2-4 | — |
| Debian 3.1 | tiff | 3.7.2-5 | DSA-1091-1 |
| Debian 3.0 | tiff | 3.5.5-7woody2 | DSA-1091-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libtiff +1 | 3.6.1-12.el4_7.2 | RHSA-2008:0848 |
Advisories 2
- RHSA-2008:0848 Red Hat Security Advisory: libtiff security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1091-1 tiff - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-3486 vdb-entry
- 31670 third-party-advisory
- MDKSA-2006:102 vendor-advisory
- ADV-2006-2197 vdb-entry
- 20520 third-party-advisory
- 20766 third-party-advisory
- 20488 third-party-advisory
- GLSA-200607-03 vendor-advisory
- 20501 third-party-advisory
- 27222 third-party-advisory
- ADV-2007-4034 vdb-entry
- http://bugzilla.remotesensing.org/show_bug.cgi?id=1196
- oval:org.mitre.oval:def:9788 vdb-entry signature
- DSA-1091 vendor-advisory
- RHSA-2008:0848 vendor-advisory
- 27181 third-party-advisory
- 20693 third-party-advisory
- SUSE-SR:2006:014 vendor-advisory
- 27832 third-party-advisory
- libtiff-tiff2pdf-bo(26991) vdb-entry
- 201331 vendor-advisory
- 21002 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355
- 18331 vdb-entry
- USN-289-1 vendor-advisory
- 103160 vendor-advisory