PT-2024-1465 · Libtiff+11 · Libtiff+11

Yisumi · Published 2023-11-03 · Updated 2026-04-10 · CVE-2023-52356

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibTIFF (affected versions not specified)

Description The issue is related to a segment fault (SEGV) flaw in the LibTIFF library, specifically in the TIFFReadRGBATileExt() API endpoint. This flaw can be triggered by passing a crafted TIFF file, allowing a remote attacker to cause a heap-buffer overflow, which can lead to a denial of service. The vulnerability is associated with a buffer overflow in memory, potentially enabling a remote attacker to disrupt service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALSA-2024:5079

ALSA-2026:7081

ALT-PU-2025-7532

ALT-PU-2025-8255

AZL-34077

AZL-34955

AZL-43891

AZL-45204

BDU:2024-00967

CESA-2024_5079

CVE-2023-52356

DLA-3758-1

DLA-4026-1

INFSA-2024_5079

INFSA-2025_20801

MGASA-2024-0055

OPENSUSE-SU-2024:13627-1

OPENSUSE-SU-2025_0753-1

RHSA-2024:5079

RHSA-2024_5079

RHSA-2025:20801

RHSA-2025_20801

RHSA-2026:5958

RHSA-2026:7081

RHSA-2026:7304

RLSA-2024:5079

SUSE-SU-2024:0593-1

SUSE-SU-2024:0594-1

SUSE-SU-2024_0593-1

SUSE-SU-2024_0594-1

SUSE-SU-2025:0753-1

SUSE-SU-2025:20971-1

SUSE-SU-2025:21037-1

USN-6644-1

USN-6644-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Libtiff

Linuxmint

Apple Macos

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 146

• https://osv.dev/vulnerability/ALSA-2024:5079 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-7081.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7081 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3462 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-6277 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/705229 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52356 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-5079.html · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-5079.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52356 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0055 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20971-1 · Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/merge_requests/546 · Patch