Overview 158 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 10 public PoC · 0 EPSS ≥ 0.5
158matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
10public PoC6.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
11
7.0%
Not applicable
147
93.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
158
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
10
6.3%
Proof of concept only
26
16.5%
Forecast only
0
0.0%
No public exploit
122
77.2%
split by
peak 32 / year
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20053
Not applicable3
Medium3
not blocked3
No public exploit3
20064
Not applicable4
Medium4
not blocked4
Working exploit published3
No public exploit1
20070
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20091
Not applicable1
Medium1
not blocked1
Working exploit published1
201012
Not applicable12
Medium12
not blocked12
Working exploit published3
No public exploit9
20113
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20125
Not applicable5
Medium5
not blocked5
No public exploit5
20134
Not applicable4
Medium4
not blocked4
No public exploit4
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20151
Not applicable1
Medium1
not blocked1
No public exploit1
201611
Not applicable11
Medium11
not blocked11
No public exploit11
201729
Not applicable29
Medium29
not blocked29
Working exploit published2
No public exploit27
201811
Not applicable11
Medium11
not blocked11
No public exploit11
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20212
Not applicable2
Medium2
not blocked2
No public exploit2
202230
Outside Waratek scope11
Not applicable19
Medium30
not blocked30
Proof of concept only5
No public exploit25
202332
Not applicable32
Medium32
not blocked32
Proof of concept only19
No public exploit13
20240
20252
Not applicable2
Medium2
not blocked2
Proof of concept only2
20262
Not applicable2
Medium2
not blocked2
No public exploit2
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-61145 | Medium | 2026-02-23 | Not applicable | No public exploit | libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c. |
| CVE-2025-61143 | Medium | 2026-02-23 | Not applicable | No public exploit | libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c. |
| CVE-2025-8851 | Medium | 2025-08-11 | Not applicable | Proof of concept only | A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue. |
| CVE-2025-8177 | Medium | 2025-07-26 | Not applicable | Proof of concept only | A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2023-6228 | Medium | 2023-12-18 | Not applicable | No public exploit | An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. |
| CVE-2023-6277 | Medium | 2023-11-24 | Not applicable | Proof of concept only | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. |
| CVE-2023-3164 | Medium | 2023-11-02 | Not applicable | Proof of concept only | A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. |
| CVE-2023-41175 | Medium | 2023-10-05 | Not applicable | No public exploit | A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. |
| CVE-2023-40745 | Medium | 2023-10-05 | Not applicable | No public exploit | LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. |
| CVE-2023-3576 | Medium | 2023-10-04 | Not applicable | No public exploit | A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service. |
| CVE-2022-40090 | Medium | 2023-08-22 | Not applicable | Proof of concept only | An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. |
| CVE-2020-18768 | Medium | 2023-08-22 | Not applicable | Proof of concept only | There exists one heap buffer overflow in _TIFFmemcpy in tif_unix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file. |
| CVE-2023-3618 | Medium | 2023-07-12 | Not applicable | No public exploit | A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. |
| CVE-2023-2908 | Medium | 2023-06-30 | Not applicable | No public exploit | A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service. |
| CVE-2023-26966 | Medium | 2023-06-29 | Not applicable | Proof of concept only | libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. |
| CVE-2023-25433 | Medium | 2023-06-29 | Not applicable | Proof of concept only | libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. |
| CVE-2023-25435 | Medium | 2023-06-21 | Not applicable | No public exploit | libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. |
| CVE-2023-3316 | Medium | 2023-06-19 | Not applicable | No public exploit | A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. |
| CVE-2023-26965 | Medium | 2023-06-14 | Not applicable | No public exploit | loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. |
| CVE-2023-30775 | Medium | 2023-05-19 | Not applicable | No public exploit | A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c. |
| CVE-2023-30774 | Medium | 2023-05-19 | Not applicable | No public exploit | A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values. |
| CVE-2023-2731 | Medium | 2023-05-17 | Not applicable | Proof of concept only | A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service. |
| CVE-2023-30086 | Medium | 2023-05-09 | Not applicable | No public exploit | Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c. |
| CVE-2023-1916 | Medium | 2023-04-10 | Not applicable | No public exploit | A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. |
| CVE-2022-4645 | Medium | 2023-03-03 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. |
| CVE-2023-0804 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. |
| CVE-2023-0803 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. |
| CVE-2023-0802 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. |
| CVE-2023-0801 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. |
| CVE-2023-0800 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. |
| CVE-2023-0799 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. |
| CVE-2023-0798 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. |
| CVE-2023-0797 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. |
| CVE-2023-0796 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. |
| CVE-2023-0795 | Medium | 2023-02-13 | Not applicable | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. |
| CVE-2022-48281 | Medium | 2023-01-23 | Not applicable | Proof of concept only | processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. |
| CVE-2022-3627 | Medium | 2022-10-21 | Outside Waratek scope | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. |
| CVE-2022-3626 | Medium | 2022-10-21 | Outside Waratek scope | No public exploit | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. |
| CVE-2022-3599 | Medium | 2022-10-21 | Outside Waratek scope | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. |
| CVE-2022-3598 | Medium | 2022-10-21 | Outside Waratek scope | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. |
| CVE-2022-3597 | Medium | 2022-10-21 | Outside Waratek scope | Proof of concept only | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. |
| CVE-2022-2521 | Medium | 2022-08-31 | Not applicable | No public exploit | It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. |
| CVE-2022-2520 | Medium | 2022-08-31 | Not applicable | No public exploit | A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. |
| CVE-2022-2519 | Medium | 2022-08-31 | Not applicable | No public exploit | There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 |
| CVE-2022-1355 | Medium | 2022-08-31 | Not applicable | No public exploit | A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service. |
| CVE-2022-1354 | Medium | 2022-08-31 | Not applicable | No public exploit | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. |
| CVE-2022-2953 | Medium | 2022-08-29 | Not applicable | No public exploit | LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8. |
| CVE-2022-2869 | Medium | 2022-08-17 | Not applicable | No public exploit | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. |
| CVE-2022-2868 | Medium | 2022-08-17 | Not applicable | No public exploit | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. |
| CVE-2022-2867 | Medium | 2022-08-17 | Not applicable | No public exploit | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. |
| CVE-2022-34526 | Medium | 2022-07-29 | Outside Waratek scope | No public exploit | A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. |
| CVE-2022-34266 | Medium | 2022-07-19 | Not applicable | No public exploit | The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. |
| CVE-2022-2058 | Medium | 2022-06-30 | Outside Waratek scope | No public exploit | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. |
| CVE-2022-2057 | Medium | 2022-06-30 | Outside Waratek scope | No public exploit | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. |
| CVE-2022-2056 | Medium | 2022-06-30 | Outside Waratek scope | No public exploit | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. |
| CVE-2022-1623 | Medium | 2022-05-11 | Not applicable | No public exploit | LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. |
| CVE-2022-1622 | Medium | 2022-05-11 | Not applicable | No public exploit | LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. |
| CVE-2022-1210 | Medium | 2022-04-03 | Not applicable | Proof of concept only | A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. |
| CVE-2022-1056 | Medium | 2022-03-28 | Outside Waratek scope | No public exploit | Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. |
| CVE-2022-0924 | Medium | 2022-03-11 | Not applicable | No public exploit | Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4. |
| CVE-2022-0909 | Medium | 2022-03-11 | Not applicable | No public exploit | Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa. |
| CVE-2022-0907 | Medium | 2022-03-11 | Not applicable | No public exploit | Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2. |
| CVE-2022-0865 | Medium | 2022-03-10 | Outside Waratek scope | No public exploit | Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045. |
| CVE-2022-0562 | Medium | 2022-02-11 | Not applicable | No public exploit | Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. |
| CVE-2022-0561 | Medium | 2022-02-11 | Not applicable | No public exploit | Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. |
| CVE-2022-22844 | Medium | 2022-01-10 | Not applicable | No public exploit | LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. |
| CVE-2020-35522 | Medium | 2021-03-09 | Not applicable | No public exploit | In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. |
| CVE-2020-35521 | Medium | 2021-03-09 | Not applicable | No public exploit | A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service. |
| CVE-2014-8128 | Medium | 2020-02-12 | Not applicable | No public exploit | LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image. |
| CVE-2019-14973 | Medium | 2019-08-14 | Not applicable | No public exploit | _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. |
| CVE-2019-7663 | Medium | 2019-02-09 | Not applicable | No public exploit | An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900. |
| CVE-2018-19210 | Medium | 2018-11-12 | Not applicable | No public exploit | In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. |
| CVE-2018-18661 | Medium | 2018-10-26 | Not applicable | No public exploit | An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. |
| CVE-2018-17000 | Medium | 2018-09-13 | Not applicable | No public exploit | A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. |
| CVE-2018-10963 | Medium | 2018-05-10 | Not applicable | No public exploit | The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. |
| CVE-2018-10801 | Medium | 2018-05-08 | Not applicable | No public exploit | TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff. |
| CVE-2018-10779 | Medium | 2018-05-07 | Not applicable | No public exploit | TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. |
| CVE-2018-10126 | Medium | 2018-04-21 | Not applicable | No public exploit | ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c. |
| CVE-2014-8130 | Medium | 2018-03-12 | Not applicable | No public exploit | The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither. |
| CVE-2018-7456 | Medium | 2018-02-24 | Not applicable | No public exploit | A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) |
| CVE-2018-5784 | Medium | 2018-01-19 | Not applicable | No public exploit | In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. |
| CVE-2017-18013 | Medium | 2018-01-01 | Not applicable | No public exploit | In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. |
| CVE-2017-13727 | Medium | 2017-08-29 | Not applicable | No public exploit | There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. |
| CVE-2017-13726 | Medium | 2017-08-29 | Not applicable | No public exploit | There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. |
| CVE-2017-11613 | Medium | 2017-07-26 | Not applicable | No public exploit | In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. |
| CVE-2017-9937 | Medium | 2017-06-26 | Not applicable | No public exploit | In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack. |
| CVE-2017-9936 | Medium | 2017-06-26 | Not applicable | Working exploit published | In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack. |
| CVE-2014-8127 | Medium | 2017-06-26 | Not applicable | No public exploit | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. |
| CVE-2017-9815 | Medium | 2017-06-22 | Not applicable | No public exploit | In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file. |
| CVE-2017-9404 | Medium | 2017-06-02 | Not applicable | No public exploit | In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file. |
| CVE-2017-9403 | Medium | 2017-06-02 | Not applicable | No public exploit | In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file. |
| CVE-2017-9147 | Medium | 2017-05-22 | Not applicable | Working exploit published | LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file. |
| CVE-2017-9117 | Medium | 2017-05-21 | Not applicable | No public exploit | In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release). |
| CVE-2016-10371 | Medium | 2017-05-10 | Not applicable | No public exploit | The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file. |
| CVE-2016-5322 | Medium | 2017-04-11 | Not applicable | No public exploit | The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image. |
| CVE-2017-7595 | Medium | 2017-04-09 | Not applicable | No public exploit | The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. |
| CVE-2017-7594 | Medium | 2017-04-09 | Not applicable | No public exploit | The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image. |
| CVE-2017-7593 | Medium | 2017-04-09 | Not applicable | No public exploit | tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image. |
| CVE-2016-10267 | Medium | 2017-03-24 | Not applicable | No public exploit | LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8. |
| CVE-2016-10266 | Medium | 2017-03-24 | Not applicable | No public exploit | LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. |