Description
Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.0.3-12 | — |
| Debian 13 | tiff | 4.0.3-12 | — |
| Debian 12 | tiff | 4.0.3-12 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libtiff +3 | 4.0.3-27.el7_3 | RHSA-2017:0225 |
| RHEL 6 | libtiff +2 | 3.9.4-21.el6_8 | RHSA-2017:0225 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | tiff | 3.8.2-141.169.22.1 | SUSE-SU-2018:3879-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 11 SP4 | tiff | 3.8.2-141.169.22.1 | SUSE-SU-2018:3879-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libtiff +3 | 4.0.3-27.el7_3 | ELSA-2017-0225 |
Advisories 3
- RHSA-2017:0225 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2018:3879-1 Security update for tiff SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2017-0225 Moderate: libtiff security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 1, 2017
References
- 94717 vdb-entry
- http://download.osgeo.org/libtiff/tiff-4.0.4.tar.gz
- http://www.floyd.ch/?p=874BMP
- RHSA-2017:0225 vendor-advisory