CVE-2023-0799: Use After Free
LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a heap-use-after-free error when processing TIFF files in extractContigSamplesShifted32bits in tools/tiffcrop.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could overflow a buffer and cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0799?
The severity of CVE-2023-0799 is medium.
How can CVE-2023-0799 be exploited?
CVE-2023-0799 can be exploited by sending a crafted tiff file to the affected system, causing a denial-of-service.
How can I fix CVE-2023-0799?
If you compile libtiff from sources, the fix is available with commit afaabc3e.
Which versions of LibTIFF are affected by CVE-2023-0799?
LibTIFF versions 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, and 4.5.1+git230720-1 are affected by CVE-2023-0799.
Where can I find more information about CVE-2023-0799?
You can find more information about CVE-2023-0799 at the following references: [Reference 1](https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68), [Reference 2](https://gitlab.com/libtiff/libtiff/-/issues/494), [Reference 3](https://security-tracker.debian.org/tracker/CVE-2023-0799).