Description
TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic operations".
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.8.2-6 | — |
| Debian 13 | tiff | 3.8.2-6 | — |
| Debian 12 | tiff | 3.8.2-6 | — |
| Debian 3.1 | tiff | 3.7.2-7 | DSA-1137-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libtiff +1 | 3.6.1-12 | RHSA-2006:0603 |
| RHEL 3 | kdegraphics +1 | 7:3.1.3-3.10 | RHSA-2006:0648 |
| RHEL 3 | libtiff +1 | 3.5.7-25.el3.4 | RHSA-2006:0603 |
Advisories 3
- RHSA-2006:0648 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0603 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1137-1 tiff - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21501 third-party-advisory
- MDKSA-2006:136 vendor-advisory
- 21537 third-party-advisory
- 21632 third-party-advisory
- GLSA-200608-07 vendor-advisory
- 21338 third-party-advisory
- USN-330-1 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm
- 1016628 vdb-entry
- DSA-1137 vendor-advisory
- 21370 third-party-advisory
- 21598 third-party-advisory
- RHSA-2006:0648 vendor-advisory
- MDKSA-2006:137 vendor-advisory
- ADV-2007-4034 vdb-entry
- SUSE-SA:2006:044 vendor-advisory
- 21290 third-party-advisory
- 21274 third-party-advisory
- ADV-2006-3105 vdb-entry
- RHSA-2006:0603 vendor-advisory
- 21304 third-party-advisory
- SSA:2006-230-01 vendor-advisory
- https://issues.rpath.com/browse/RPL-558
- 27832 third-party-advisory
- 21346 third-party-advisory
- 201331 vendor-advisory
- 19286 vdb-entry
- 21319 third-party-advisory
- 21392 third-party-advisory
- 21334 third-party-advisory
- oval:org.mitre.oval:def:10916 vdb-entry signature
- 22036 third-party-advisory
- 2006-0044 vendor-advisory
- 103160 vendor-advisory