Description
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.8.2-13 | — |
| Debian 13 | tiff | 3.8.2-13 | — |
| Debian 12 | tiff | 3.8.2-13 | — |
| Debian 5.0 | tiff | 3.8.2-11.2 | DSA-1835-1 |
| Debian 4.0 | tiff | 3.8.2-7+etch3 | DSA-1835-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libtiff +1 | 3.8.2-7.el5_3.4 | RHSA-2009:1159 |
| RHEL 4 | libtiff +1 | 3.6.1-12.el4_8.4 | RHSA-2009:1159 |
| RHEL 3 | libtiff +1 | 3.5.7-33.el3 | RHSA-2009:1159 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.0.7-1.1 | openSUSE-SU-2024:10554-1 |
Advisories 3
- RHSA-2009:1159 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1835-1 tiff - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10554-1 libtiff-devel-32bit-4.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 35817 third-party-advisory
- 35866 third-party-advisory
- FEDORA-2009-7724 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2347
- 55821 vdb-entry
- FEDORA-2009-7775 vendor-advisory
- ADV-2009-1870 vdb-entry
- http://www.ocert.org/advisories/ocert-2009-012.html
- oval:org.mitre.oval:def:10988 vdb-entry signature
- 1022539 vdb-entry
- ADV-2011-0621 vdb-entry
- USN-801-1 vendor-advisory
- 35811 third-party-advisory
- 35883 third-party-advisory
- GLSA-201209-02 vendor-advisory
- 36194 third-party-advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=2079
- 20090713 [oCERT-2009-012] libtiff tools integer overflows mailing-list
- MDVSA-2009:150 vendor-advisory
- GLSA-200908-03 vendor-advisory
- libtiff-rgb2ycbcr-tiff2rgba-bo(51688) vdb-entry
- 35911 third-party-advisory
- http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/
- 55822 vdb-entry
- RHSA-2009:1159 vendor-advisory
- 35652 vdb-entry
- DSA-1835 vendor-advisory
- MDVSA-2011:043 vendor-advisory
- 50726 third-party-advisory