Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2023-52355

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 1.83 % · percentile 79 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Description

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
libtiffaffected 0 < 4.6.0
Red Hat · Red Hat Enterprise Linux 10unaffected 0:4.6.0-8.el10_2.4 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:4.6.0-6.el10_0.4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:4.4.0-15.el9 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:4.4.0-13.el9_6.5 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 3.2.2-1765379088 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 3.2.2-1765379049 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 3.2.2-1764871796 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 1772160593 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 1772160625 < *
Red Hat · Red Hat Discovery 2unaffected 2.4.0-1763656152 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1790276886 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1790276884 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1790277045 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1790276889 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1790276974 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1790703497 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1790703506 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1790703590 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1790703568 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD