CVE-2023-40745 — Integer Overflow or Wraparound in Libtiff

CWE-190 — Integer Overflow or Wraparound7 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 43.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LibtiffRedhat Enterprise Linux
Timeline
PublishedOct 5
Latest updateOct 10

Description

LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDlibtiff/libtiff< 4.6.0

Also affects: Enterprise Linux 8.0, 9.0

🔴Vulnerability Details

3
CVEList
Libtiff: integer overflow in tiffcp.c↗2023-10-05
▶
GHSA
GHSA-w737-xjxg-h9mw: LibTIFF is vulnerable to an integer overflow↗2023-10-05
▶
OSV
CVE-2023-40745: LibTIFF is vulnerable to an integer overflow↗2023-10-05
▶

📋Vendor Advisories

3
Microsoft
Libtiff: integer overflow in tiffcp.c↗2023-10-10
▶
Red Hat
libtiff: integer overflow in tiffcp.c↗2023-07-21
▶
Debian
CVE-2023-40745: tiff - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers ...↗2023
▶
CVE-2023-40745 — Integer Overflow or Wraparound | cvebase