CVE-2023-3164

2023-11-0212:15:09

Google

osv.dev

cve-2023-3164

denial of service

crafted file

tiff

libtiff

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

High

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

9.6%

JSON

A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.

CPENameOperatorVersion
libtiffeq4.0.2
libtiffeq4.5.1
libtiffeq3.7.2
libtiffeq3.7.4
libtiffeq4.5.1rc2
libtiffeq3.7.0beta
libtiffeq4.6.0rc1
libtiffeq4.2.0
libtiffeq3.7.0alpha
libtiffeq3.7.0beta2

Name	Operator	Version
libtiff	eq	4.0.2
libtiff	eq	4.5.1
libtiff	eq	3.7.2
libtiff	eq	3.7.4
libtiff	eq	4.5.1rc2
libtiff	eq	3.7.0beta
libtiff	eq	4.6.0rc1
libtiff	eq	4.2.0
libtiff	eq	3.7.0alpha
libtiff	eq	3.7.0beta2