LI
Product
libtiff
262
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 70Medium 122Low 5
Watch
Add libtiff to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8851 | 5.3 | Aug 11 | A vulnerability was determined in LibTIFF up to 4.5.1 Affected: through 4.5.1 |
| CVE-2025-61145 | 5.0 | Feb 23 | libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c Affected: before 4.7.1 |
| CVE-2017-9117 | 4.0 | May 21 | In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input,… Affected: 4.0.7 |
| CVE-2025-8961 | 3.3 | Aug 14 | A weakness has been identified in LibTIFF 4.7.0 Affected: 4.7.0 |
| CVE-2023-6228 | 3.3 | Dec 18 | An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application… Affected: All versions, or not specified |
| CVE-2025-9165 | 2.5 | Aug 19 | A flaw has been found in LibTIFF 4.7.0 Affected: 4.7.0 |
| CVE-2025-8534 | 2.5 | Aug 5 | A vulnerability classified as problematic was found in libtiff 4.6.0 Affected: 4.6.0 |
| CVE-2024-13978 | 2.5 | Aug 1 | A vulnerability was found in LibTIFF up to 4.7.0 Affected: through 4.7.0 |
| CVE-2014-9330 | – | Jan 20 | Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which… Affected: 4.0.3 |
| CVE-2013-4231 | – | Jan 19 | Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2)… Affected: through 4.0.2; 4.0; 4.0; 4.0; 4.0; 4.0; +4 more |
| CVE-2013-4244 | – | Sep 28 | The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly… Affected: through 4.0.3; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2013-4243 | – | Sep 10 | Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly… Affected: through 4.0.3; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2013-4232 | – | Sep 10 | Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possibly… Affected: 4.0.3 |
| CVE-2012-5581 | – | Jan 4 | Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted… Affected: through 4.0.1; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2012-4564 | – | Nov 11 | ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code… Affected: through 4.0.3 |
| CVE-2012-4447 | – | Oct 28 | Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code… Affected: through 4.0.2; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2012-3401 | – | Aug 13 | The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error… Affected: through 4.0.2; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2012-2113 | – | Jul 22 | Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a… Affected: through 4.0.1; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2012-2088 | – | Jul 22 | Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash)… Affected: through 3.9.4; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2012-1173 | – | Jun 4 | Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly… Affected: 3.9.4 |
| CVE-2010-4665 | – | May 3 | Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or… Affected: through 3.9.4; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2009-5022 | – | May 3 | Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file Affected: through 3.9.4; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2011-1167 | – | Mar 28 | Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted… Affected: through 3.9.4; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2010-3087 | – | Sep 28 | LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TIFF… Affected: 3.9.2-5.2.1 |
| CVE-2010-2631 | – | Jul 6 | LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote… Affected: 3.9.0 |
| CVE-2010-2630 | – | Jul 6 | The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows… Affected: 3.9.0 |
| CVE-2010-2483 | – | Jul 6 | The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid… Affected: 3.9.0 |
| CVE-2010-2482 | – | Jul 6 | LibTIFF 3.9.4 and earlier does not properly handle an invalid td_stripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 3.9.4; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2010-2481 | – | Jul 6 | The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service… Affected: through 3.9.3; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2010-2597 | – | Jul 2 | The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of… Affected: 3.9.0; 3.9.2 |
| CVE-2010-2596 | – | Jul 2 | The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application… Affected: 3.9.0; 3.9.2 |
| CVE-2010-2595 | – | Jul 2 | The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause… Affected: 3.9.0; 3.9.2 |
| CVE-2010-2233 | – | Jul 2 | tif_getimage.c in LibTIFF 3.9.0 and 3.9.2 on 64-bit platforms, as used in ImageMagick, does not properly perform vertical flips, which allows remote attackers to cause a denial of… Affected: 3.9.0; 3.9.2 |
| CVE-2010-2443 | – | Jun 24 | The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… Affected: through 3.9.2; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2010-2067 | – | Jun 24 | Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tif_dirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application… Affected: before 3.9.4 |
| CVE-2010-2065 | – | Jun 24 | Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a… Affected: through 3.9.2; 3.4; 3.4; 3.4; 3.4; 3.4; +34 more |
| CVE-2009-2347 | – | Jul 14 | Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF… Affected: 3.8.0; 3.8.1; 3.8.2; 3.9; 4.0 |
| CVE-2009-2285 | – | Jul 1 | Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different… Affected: 3.8.2 |
| CVE-2008-2327 | – | Aug 27 | Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow… Affected: through 3.8.2; 3.4; 3.5.1; 3.5.2; 3.5.3; 3.5.4; +9 more |
| CVE-2006-3462 | – | Aug 3 | Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors… Affected: through 3.8.1 |
| CVE-2006-3465 | – | Aug 3 | Unspecified vulnerability in the custom tag support for the TIFF library (libtiff) before 3.8.2 allows remote attackers to cause a denial of service (instability or crash) and… Affected: through 3.8.1 |
| CVE-2006-3459 | – | Aug 3 | Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute… Affected: through 3.8.1; 3.4; 3.4; 3.4; 3.4; 3.4; +32 more |
| CVE-2006-3460 | – | Aug 3 | Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute… Affected: through 3.8.1 |
| CVE-2006-3461 | – | Aug 3 | Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors Affected: through 3.8.1 |
| CVE-2006-3464 | – | Aug 3 | TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values… Affected: through 3.8.1 |
| CVE-2006-3463 | – | Aug 3 | The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows… Affected: through 3.8.1 |
| CVE-2006-2193 | – | Jun 8 | Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary… Affected: through 3.8.2; 3.4; 3.5.1; 3.5.2; 3.5.3; 3.5.4; +9 more |
| CVE-2006-2656 | – | May 30 | Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename Affected: through 3.8.2; 3.4; 3.5.1; 3.5.2; 3.5.3; 3.5.4; +9 more |
| CVE-2006-2120 | – | May 1 | The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the… Affected: 3.8.1 |
| CVE-2006-2024 | – | Apr 25 | Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray… Affected: through 3.8.0; 3.4; 3.5.1; 3.5.2; 3.5.3; 3.5.4; +7 more |