K000157989: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2016-9453 The t2preadwritepdfimagetile function in LibTIFF allows remote attackers to cause a denial of service out-of-bounds write and crash or possibly execute arbitrary code via a JPEG file with a TIFFTAGJPEGTABLES of length one. CVE-2016-5323 The...

K000157987: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2022-0891 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential...

K000157985: LibTIFF vulnerabilities CVE-2020-35522, CVE-2020-35521, CVE-2020-35524, and CVE-2020-35523

Security Advisory Description CVE-2020-35522 In LibTIFF, there is a memory malloc failure in tifpixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. CVE-2020-35521 A flaw was found in libtiff. Due to a memory allocation failure in tifread.c, a...

K000157984: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2012-4564 ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory...

JLSEC-2025-292 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in `libtiff/tif_unix.c:368`, invoked by...

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tifunix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e...

JLSEC-2025-322 A weakness has been identified in LibTIFF 4.7.0

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited...

JLSEC-2025-285 LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in `tools/tiffcrop.c:7345`, allowing...

LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125...

JLSEC-2025-317 A vulnerability was found in LibTIFF up to 4.7.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function gethistogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the publi...

JLSEC-2025-315 An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to...

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64 API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB...

JLSEC-2025-309 There exists one heap buffer overflow in `_TIFFmemcpy` in `tif_unix.c` in libtiff 4.0.10, which...

There exists one heap buffer overflow in TIFFmemcpy in tifunix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file...

JLSEC-2025-312 LibTIFF is vulnerable to an integer overflow

LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service application crash or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow...

JLSEC-2025-278 libtiff's tiffcrop tool has a `uint32_t` underflow which leads to out of bounds read and write in...

libtiff's tiffcrop tool has a uint32t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering...

JLSEC-2025-296 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in `libtiff/tif_unix.c:368`, invoked by...

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tifunix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee12...

JLSEC-2025-318 A vulnerability was found in LibTIFF up to 4.7.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It...

JLSEC-2025-252 An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in...

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tifdirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file...

JLSEC-2025-279 LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in `tools/tiffcrop.c:6905`, allowing...

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8...

JLSEC-2025-261 Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in...

Null source pointer passed as an argument to memcpy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c...

JLSEC-2025-307 A null pointer dereference issue was found in Libtiff's `tif_dir.c` file

A null pointer dereference issue was found in Libtiff's tifdir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial o...

JLSEC-2025-282 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows...

Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact...

JLSEC-2025-283 LibTIFF 4.4.0 has an out-of-bounds write in `_TIFFmemcpy` in `libtiff/tif_unix.c:346` when called...

LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit...