CVE-2023-41175: Libtiff: potential integer overflow in raw2tiff.c
A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Other sources
LibTIFF is vulnerable to a denial of service, caused by an integer overflow in raw2tiff.c. By persuading a victim to open a specially crafted tiff image file, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Multiple potential integer overflow in raw2tiff.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-41175.
What is the title of the vulnerability?
The title of the vulnerability is 'A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c.'
What is the severity of CVE-2023-41175?
The severity of CVE-2023-41175 is medium with a CVSS score of 6.5.
How does CVE-2023-41175 affect libtiff?
CVE-2023-41175 affects libtiff versions up to, but not including, 4.6.0.
How can I fix CVE-2023-41175?
To fix CVE-2023-41175, you should update libtiff to version 4.6.0 or above.