CVE-2023-0804: Buffer Overflow
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a heap-based buffer overflow when processing TIFF files in extractContigSamplesShifted24bits in tools/tiffcrop.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could overflow a buffer and cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0804?
The severity of CVE-2023-0804 is medium with a severity value of 5.5.
How does CVE-2023-0804 affect LibTIFF?
CVE-2023-0804 affects LibTIFF version 4.4.0 and can cause a denial-of-service through a crafted tiff file.
How can I fix CVE-2023-0804 in a source code compilation of LibTIFF?
The fix for CVE-2023-0804 in a source code compilation of LibTIFF is available with commit 33aee127.
What is the affected version range of CVE-2023-0804 in Debian's tiff package?
CVE-2023-0804 is affected in Debian's tiff package versions 4.1.0+git191117-2~deb10u4 - 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, and 4.5.1+git230720-1.
What is the CWE (Common Weakness Enumeration) ID for CVE-2023-0804?
The CWE ID for CVE-2023-0804 is CWE-787.