Junglewise Threat Intelligence

CVE-2023-52356: libtiff heap buffer overflow in TIFFReadRGBATileExt

CVE-2023-52356 · Severity: high · CVSS 7.5 · Published 2024-01-25

Technologies: Libtiff, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Libtiff, Red Hat.

Executive brief

A vulnerability was found in libtiff, a widely used library for processing TIFF image files. By providing a specially crafted image file, an attacker can cause the software to crash. This results in a denial of service, potentially disrupting applications or systems that automatically process image uploads or attachments.

Technical details

A segmentation fault (SEGV) flaw exists in libtiff within the TIFFReadRGBATileExt() API. The vulnerability is triggered when the library processes a maliciously crafted TIFF file, leading to a heap-based buffer overflow. This is an out-of-bounds write vulnerability (CWE-787/CWE-122). An attacker can exploit this remotely without authentication or user interaction to cause a denial of service (DoS) by crashing the application linked against libtiff. Patches have been released by the libtiff maintainers and various Linux distributions including Red Hat and Debian.

Affected products

  • libtiff libtiff 4.0.9, 4.4.0
  • Red Hat Enterprise Linux 8 8.10
  • Red Hat Enterprise Linux 9 9.7

Timeline

  • 2024-01-25: disclosed: Initial NVD publication date
  • 2024-08-07: patched: Red Hat released security updates for RHEL 8
  • 2025-11-11: patched: Red Hat released security updates for RHEL 9

References

Related threats