PT-2023-4906 · Libtiff+6 · Libtiff+6

Xiaoxiaoafeifei · Published 2023-04-10 · Updated 2026-03-31 · CVE-2023-1916

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtiff versions 4.x

Description The issue is related to a flaw in the extractImageSection function of the libtiff library, which can cause an out-of-bounds read in memory. This can lead to a denial of service and limited information disclosure when a specially crafted TIFF file is processed. The extractImageSection function in tools/tiffcrop.c is specifically affected.

Recommendations For libtiff versions 4.x, improved checks have been implemented to address the issue. As a temporary workaround, consider restricting the use of the extractImageSection function in tools/tiffcrop.c until the improved checks are applied. Additionally, avoid processing specially crafted TIFF files with the affected libtiff versions to minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2025-7185

ALT-PU-2025-7532

ALT-PU-2025-8255

AZL-26152

BDU:2023-05399

CVE-2023-1916

ECHO-56EF-42C6-64A5

OESA-2024-1663

SUSE-SU-2023:4736-1

SUSE-SU-2023:4869-1

USN-6428-1

Affected Products

Alt Linux

Debian

Linuxmint

Apple Macos

Suse

Ubuntu

Libtiff

References · 45

• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/537 · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/536 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1916 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4869-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-1916 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05399 · Security Note
• https://osv.dev/vulnerability/USN-6428-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4736-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1916 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2023-1916 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-1916 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1916 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1916 · Vendor Advisory