PT-2023-3451 · Libtiff+6 · Libtiff+6

Han Zheng + 1 · Published 2023-04-17 · Updated 2025-06-26 · CVE-2023-30774

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtiff (affected versions not specified)

Description The issue is related to a heap buffer overflow in the libtiff library when processing the TIFFTAG INKNAMES and TIFFTAG NUMBEROFINKS parameters. This can lead to a denial of service or potentially allow an attacker to execute arbitrary code, causing unexpected application termination.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALSA-2023:2340

ALT-PU-2025-7185

ALT-PU-2025-7532

ALT-PU-2025-8255

AZL-44023

AZL-44907

BDU:2023-03634

CVE-2023-30774

RHSA-2023:2340

RHSA-2023_2340

ROSA-SA-2025-2657

Affected Products

Alt Linux

Almalinux

Astra Linux

Apple Macos

Red Hat

Red Os

Libtiff

References · 54

• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/463 · Exploit
• https://osv.dev/vulnerability/AZL-44907 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-30774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30774 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-30774 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-30774 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03634 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-30774 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30774 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2340.html · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-30774 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44023 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-2340.html · Vendor Advisory