PT-2023-4826 · Libtiff+7 · Libtiff+7

Su Laus

·

Published

2023-06-29

·

Updated

2025-06-26

·

CVE-2023-26966

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions libtiff version 4.5.0
Description The issue is caused by a buffer overflow on the stack in the uv encode() function of the LibTIFF library. This can occur when the library reads a corrupted little-endian TIFF file and specifies the output to be big-endian. Exploitation of this issue may allow an attacker to cause a denial of service.
Recommendations For libtiff version 4.5.0, consider disabling the uv encode() function as a temporary workaround until a patch is available to prevent potential exploitation when reading corrupted little-endian TIFF files and specifying big-endian output.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2023:6575
ALT-PU-2025-7532
ALT-PU-2025-8255
AZL-27303
BDU:2023-05289
CVE-2023-26966
DLA-3513-1
DLA-4026-1
MGASA-2023-0255
OESA-2023-1402
OPENSUSE-SU-2023_4370-1
RHSA-2023:6575
RHSA-2023_6575
SUSE-SU-2023:4370-1
SUSE-SU-2023:4371-1
USN-6229-1
USN-6290-1

Affected Products

Alt Linux
Almalinux
Astra Linux
Linuxmint
Red Hat
Suse
Ubuntu
Libtiff