Vulnerabilities > Libtiff

DATE CVE VULNERABILITY TITLE RISK
2020-02-12 CVE-2014-8128 Out-Of-Bounds Write vulnerability in Libtiff
LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
4.3
2019-10-14 CVE-2019-17546 Integer Overflow OR Wraparound vulnerability in multiple products
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
6.8
2019-08-14 CVE-2019-14973 Integer Overflow OR Wraparound vulnerability in Libtiff
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards.
network
libtiff CWE-190
4.3
2019-03-21 CVE-2017-16232 Missing Release of Resource After Effective Lifetime vulnerability in multiple products
** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c.
network
low complexity
libtiff opensuse suse CWE-772
5.0
2019-02-09 CVE-2019-7663 An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. 4.3
2019-01-11 CVE-2019-6128 Memory Leak vulnerability in multiple products
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
6.8
2018-11-12 CVE-2018-19210 Null Pointer Dereference vulnerability in multiple products
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
4.3
2018-10-26 CVE-2018-18661 Null Pointer Dereference vulnerability in multiple products
An issue was discovered in LibTIFF 4.0.9.
4.3
2018-10-22 CVE-2018-18557 Out-Of-Bounds Write vulnerability in multiple products
LibTIFF 3.9.3, 3.9.4, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.
6.8
2018-09-30 CVE-2018-17795 Out-Of-Bounds Write vulnerability in Libtiff 4.0.9
The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935.
network
libtiff CWE-787
6.8