CVE-2023-0803 describes an out-of-bounds write vulnerability in LibTIFF version 4.4.0, specifically within the tiffcrop tool. This flaw allows an unauthenticated attacker to trigger a denial-of-service condition by processing a specially crafted TIFF file. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring user interaction, and primarily impacting availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.4.0CPE matchmatch criteria | cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit 33aee127.
Feb 14, 2023libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c
Feb 12, 2023