CVE-2023-0804 is an out-of-bounds write vulnerability in LibTIFF version 4.4.0, specifically within the tiffcrop tool, which can be triggered by a crafted TIFF file. This flaw allows an unauthenticated attacker to cause a denial-of-service condition. With a CVSS score of 5.5 (Medium), this vulnerability requires local access and user interaction to exploit, but has a high impact on availability. There is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE. Organizations using LibTIFF 4.4.0 should consider applying the fix available in commit 33aee127 if compiling from source, though the overall risk is currently low due to the lack of exploitation and low EPSS score.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.4.0CPE matchmatch criteria | cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit 33aee127.
Feb 14, 2023libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c
Feb 12, 2023