CVEvulnerability

CVE-2023-52356

7.5 HIGH Published 2024-01-25 Modified 2026-10-28 Official page ↗
Status
Analyzed
Published
2024-01-25
Last modified
2026-10-28
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-122, CWE-787

Description

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

Affected configurations

• debian debian linux 10.0 • debian debian linux 11.0 • apple ipados (< 16.7.9) • apple ipados (>= 17.0 < 17.6) • apple iphone os (< 16.7.9) • apple iphone os (>= 17.0 < 17.6) • apple macos (< 12.7.6) • apple macos (>= 13.0 < 13.6.8) • apple macos (>= 14.0 < 14.6) • apple tvos (< 17.6) • apple visionos (< 1.3) • apple watchos (< 10.6) • libtiff libtiff (< 4.6.0) • redhat ai inference server (>= 3.2.0 < 3.2.2) • redhat ai inference server 3.3.0 • redhat codeready linux builder 8.0 • redhat codeready linux builder 9.0 • redhat codeready linux builder 10.0 • redhat codeready linux builder eus 9.6 • redhat codeready linux builder eus 10.0 • redhat discovery 2.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux 10.0 • redhat enterprise linux eus 9.6 • redhat enterprise linux eus 10.0

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References