Description
The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.9.6-1 | — |
| Debian 13 | tiff | 3.9.6-1 | — |
| Debian 12 | tiff | 3.9.6-1 | — |
| Debian 6.0 | tiff | 3.9.4-5+squeeze5 | DSA-2552-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- LibTIFF 3.9.4 - Out-Of-Order Tag Type Mismatch Remote Denial of Service EDB-34278 · dos · Jul 12, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2552-1 tiff - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=554371
- http://bugzilla.maptools.org/show_bug.cgi?id=2210
- DSA-2552 vendor-advisory
- GLSA-201209-02 vendor-advisory
- 50726 third-party-advisory