CVE-2023-0797

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.4.0

Description The issue is related to an out-of-bounds read in the tiffcrop function, specifically in libtiff/tif unix.c:368, which can be invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921. This allows attackers to cause a denial-of-service via a crafted tiff file. The problem is associated with a buffer read beyond its boundaries in memory, potentially leading to a service disruption.

Recommendations For LibTIFF version 4.4.0, users who compile libtiff from sources can apply the fix available with commit afaabc3e. As a temporary workaround, consider restricting the use of the tiffcrop function until a patch is available.