Description
Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.0.3-2 | — |
| Debian 13 | tiff | 4.0.3-2 | — |
| Debian 12 | tiff | 4.0.3-2 | — |
| Debian 7 | tiff | 4.0.2-6+deb7u2 | DSA-2744-1 |
| Debian 6.0 | tiff | 3.9.4-5+squeeze10 | DSA-2744-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | tiff | 4.0.3-7ubuntu0.1 | USN-2205-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libtiff +2 | 3.9.4-10.el6_5 | RHSA-2014:0222 |
| RHEL 5 | libtiff +1 | 3.8.2-19.el5_10 | RHSA-2014:0223 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.0.7-1.1 | openSUSE-SU-2024:10554-1 |
Advisories 5
- RHSA-2014:0223 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0222 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2205-1 tiff vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2744-1 tiff - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10554-1 libtiff-devel-32bit-4.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://bugzilla.maptools.org/show_bug.cgi?id=2450
- RHSA-2014:0223 vendor-advisory
- DSA-2744 vendor-advisory
- 54543 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=995965
- [tiff] 20130801 Vulnerabilities in libtiff 4.0.3 mailing-list
- 54628 third-party-advisory
- [oss-security] 20130809 Re: CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro mailing-list
- 61695 vdb-entry