An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:4.0.9-32.el8_10 unaffected
< *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:4.4.0-12.el9 unaffected
< *
Red Hat Red Hat Enterprise Linux 6 unknown —
Red Hat Red Hat Enterprise Linux 7 unknown —
Red Hat Red Hat Enterprise Linux 7 unknown —
Red Hat Red Hat Enterprise Linux 8 affected —

Configuration 1 [-]

AND
cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
libtiff-0:4.0.9-32.el8_10 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:5079 2024-08-07T00:00:00Z
Red Hat Enterprise Linux 9
libtiff-0:4.4.0-12.el9 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:2289 2024-04-30T00:00:00Z

No data.

Subscriptions

Vendors Products
Libtiff Subscribe
Libtiff Subscribe
Redhat Subscribe
Enterprise Linux Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-58475 An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.
Ubuntu USN Ubuntu USN USN-6644-1 LibTIFF vulnerabilities
Ubuntu USN Ubuntu USN USN-6644-2 LibTIFF vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2024:2289 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:5079 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2023-6228 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2240995 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-6228 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-6228 cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00014}

 epss

{'score': 0.00015}

Fri, 11 Oct 2024 15:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

Wed, 07 Aug 2024 22:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8

Wed, 07 Aug 2024 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
References
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-11-21T06:24:06.676Z

Reserved: 2023-11-21T05:33:19.718Z

Link: CVE-2023-6228

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-12-18T14:15:11.840

Modified: 2024-11-21T08:43:24.483

Link: CVE-2023-6228

cve-icon Redhat

Severity : Low

Publid Date: 2023-09-07T00:00:00Z

Links: CVE-2023-6228 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses