CVE-2023-52355highCWE-787

CVE-2023-52355: falha de alta gravidade em libtiff

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat Enterprise Linux 9.6 Extended Update Support

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.8%
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
libtiffRed Hat · Red Hat AI Inference Server 3.2Red Hat · Red Hat Discovery 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat · Red Hat OpenShift AI 3.0Red Hat · Red Hat OpenShift AI 3.2Red Hat · Red Hat OpenShift AI 3.4
CVEs relacionadas — libtiff

No mesmo produto, das mais perigosas para as menos.

CVE-2023-52356HIGHLibtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of serviceEPSS 2.5%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2025-5318MEDIUMLibssh: out-of-bounds read in sftp_handle()EPSS 1.9%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2024-7006HIGHLibtiff: null pointer dereference in tif_dirinfo.cEPSS 1.5%