CVE-2023-6277

Summary

An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.

Affected Software

Weaknesses

• CWE-400: Uncontrolled Resource Consumption

ADP Enrichment

CVE Program Container

Additional References

• https://access.redhat.com/security/cve/CVE-2023-6277
• https://bugzilla.redhat.com/show_bug.cgi?id=2251311
• https://gitlab.com/libtiff/libtiff/-/issues/614
• https://gitlab.com/libtiff/libtiff/-/merge_requests/545
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJIN6DTSL3VODZUGWEUXLEL5DR53EZMV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y7ZGN2MZXJ6E57W3L4YBM3ZPAU3T7T5C/
• https://security.netapp.com/advisory/ntap-20240119-0002/
• https://support.apple.com/kb/HT214119
• https://support.apple.com/kb/HT214123
• https://support.apple.com/kb/HT214122
• https://support.apple.com/kb/HT214117
• https://support.apple.com/kb/HT214118
• https://support.apple.com/kb/HT214116
• https://support.apple.com/kb/HT214120
• https://support.apple.com/kb/HT214124
• http://seclists.org/fulldisclosure/2024/Jul/16
• http://seclists.org/fulldisclosure/2024/Jul/23
• http://seclists.org/fulldisclosure/2024/Jul/21
• http://seclists.org/fulldisclosure/2024/Jul/20
• http://seclists.org/fulldisclosure/2024/Jul/17
• http://seclists.org/fulldisclosure/2024/Jul/22
• http://seclists.org/fulldisclosure/2024/Jul/18
• http://seclists.org/fulldisclosure/2024/Jul/19

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2023-6277
• https://bugzilla.redhat.com/show_bug.cgi?id=2251311
• https://gitlab.com/libtiff/libtiff/-/issues/614
• https://gitlab.com/libtiff/libtiff/-/merge_requests/545

• ←Previous
• Next→