Description
In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.0.9-4 | — |
| Debian 13 | tiff | 4.0.9-4 | — |
| Debian 12 | tiff | 4.0.9-4 | — |
| Debian 9 | tiff | 4.0.8-2+deb9u4 | DSA-4349-1 |
| Debian 8 | tiff | 4.0.3-12.3+deb8u6 | DLA-1411-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | tiff | 4.0.2-6+deb7u21 | DLA-1391-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tiff | 4.0.6-1ubuntu0.3 | USN-3606-1, USN-3602-1 |
| Ubuntu 14.04 LTS | tiff | 4.0.3-7ubuntu0.8 | USN-3606-1, USN-3602-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | tiff | 4.0.9-44.10.1 | SUSE-SU-2018:1180-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | tiff | 4.0.9-44.10.1 | SUSE-SU-2018:1180-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.3.0-1.3 | openSUSE-SU-2024:11461-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | tiff | 4.0.9-r2 | — |
| Alpine v3.23 | tiff | 4.0.9-r2 | — |
| Alpine v3.22 | tiff | 4.0.9-r2 | — |
| Alpine v3.21 | tiff | 4.0.9-r2 | — |
| Alpine v3.20 | tiff | 4.0.9-r2 | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | tiff | 4.0.9-r2 | — |
| Alpine v3.18 | tiff | 4.0.9-r2 | — |
| Alpine v3.17 | tiff | 4.0.9-r2 | — |
| Alpine v3.16 | tiff | 4.0.9-r2 | — |
| Alpine v3.15 | tiff | 4.0.9-r2 | — |
| Alpine v3.14 | tiff | 4.0.9-r2 | — |
| Alpine v3.13 | tiff | 4.0.9-r2 | — |
| Alpine v3.12 | tiff | 4.0.9-r2 | — |
| Alpine v3.11 | tiff | 4.0.9-r2 | — |
| Alpine v3.10 | tiff | 4.0.9-r2 | — |
| Alpine v3.9 | tiff | 4.0.9-r2 | — |
| Alpine v3.8 | tiff | 4.0.9-r2 | — |
| Alpine v3.7 | tiff | 4.0.9-r2 | — |
| Alpine v3.6 | tiff | 4.0.9-r2 | — |
| Alpine v3.5 | tiff | 4.0.9-r2 | — |
| Alpine v3.4 | tiff | 4.0.9-r2 | — |
Advisories 8
- USN-3606-1 tiff vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3602-1 tiff vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4349-1 tiff - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1391-1 tiff - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1411-1 tiff - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11461-1 libtiff-devel-32bit-4.3.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1180-1 Security update for tiff SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2524 libTIFF: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 9, 2025
References
- USN-3606-1 vendor-advisory
- USN-3602-1 vendor-advisory
- [debian-lts-announce] 20180531 [SECURITY] [DLA 1391-1] tiff security update mailing-list
- DSA-4349 vendor-advisory
- http://bugzilla.maptools.org/show_bug.cgi?id=2772
- [debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update mailing-list
- https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef