Description
The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.9.6-1 | — |
| Debian 13 | tiff | 3.9.6-1 | — |
| Debian 12 | tiff | 3.9.6-1 | — |
| Debian 6.0 | tiff | 3.9.4-5+squeeze5 | DSA-2552-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libtiff +1 | 3.8.2-7.el5_5.5 | RHSA-2010:0519 |
| RHEL 4 | libtiff +1 | 3.6.1-12.el4_8.5 | RHSA-2010:0519 |
Advisories 2
- RHSA-2010:0519 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2552-1 tiff - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 40527 third-party-advisory
- [oss-security] 20100623 CVE requests: LibTIFF mailing-list
- DSA-2552 vendor-advisory
- http://blackberry.com/btsc/KB27244
- ADV-2010-1761 vdb-entry
- GLSA-201209-02 vendor-advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=2208
- RHSA-2010:0519 vendor-advisory
- 40422 third-party-advisory
- 50726 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=583081