CVE-2023-26966: Buffer Overflow
Last updated 24 July 2024
Other sources
libtiff 4.5.0 is vulnerable to Buffer Overflow in uvencode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.5.1+git230720-5
Event History
Frequently Asked Questions
What is CVE-2023-26966?
CVE-2023-26966 is a vulnerability in libtiff 4.5.0 that allows a buffer overflow when reading a corrupted little-endian TIFF file.
How does libtiff 4.5.0 become vulnerable to CVE-2023-26966?
libtiff 4.5.0 becomes vulnerable to CVE-2023-26966 when it reads a corrupted little-endian TIFF file and specifies the output to be big-endian.
What is the severity of CVE-2023-26966?
The severity of CVE-2023-26966 is medium, with a severity value of 5.5.
Which software versions are affected by CVE-2023-26966?
The affected software versions include libtiff 4.5.0 and earlier versions up to 4.5.0-6.
How can I mitigate CVE-2023-26966?
To mitigate CVE-2023-26966, update to a patched version of libtiff, such as 4.5.1 or later.