Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash)…

Description

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.

Scores

EPSS (exploitation in 30 days)

8.9% · top 4.7% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• n/a
• CWE-119 (opens in a new tab)All about CWE-119 and its CVEs

Affected products

• n/a

  • affected n/a

References (41)

• APPLE-SA-2010-03-11-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• FEDORA-2009-7358 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 35866 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-7717 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2009-1637 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [oss-security] 20090623 Re: libtiff buffer underflow in LZWDecodeCompat (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://bugzilla.maptools.org/show_bug.cgi?id=2065 (opens in a new tab)x_refsource_CONFIRMx_transferred
• oval:org.mitre.oval:def:7049 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 39135 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT4004 (opens in a new tab)x_refsource_CONFIRMx_transferred
• APPLE-SA-2010-01-19-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• USN-797-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• oval:org.mitre.oval:def:10145 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://support.apple.com/kb/HT4105 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 35716 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-7763 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [oss-security] 20090621 libtiff buffer underflow in LZWDecodeCompat (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 35912 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT4070 (opens in a new tab)x_refsource_CONFIRMx_transferred
• APPLE-SA-2010-02-02-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 35883 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2009-2727 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 35695 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.lan.st/showthread.php?t=1856&page=3 (opens in a new tab)x_refsource_MISCx_transferred
• 36194 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 36831 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• GLSA-200908-03 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• ADV-2009-3184 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://support.apple.com/kb/HT4013 (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2009-7335 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• APPLE-SA-2010-03-30-2 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 267808 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• RHSA-2009:1159 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 38241 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/380149 (opens in a new tab)x_refsource_CONFIRMx_transferred
• APPLE-SA-2009-11-09-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• FEDORA-2009-7417 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• DSA-1835 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [oss-security] 20090629 CVE Request -- libtiff [was: Re: libtiff buffer underflow in LZWDecodeCompat] (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• ADV-2010-0173 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://support.apple.com/kb/HT3937 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-2285](https://trackcve.app/badge/CVE-2009-2285.svg)](https://trackcve.app/cve/CVE-2009-2285)

Record last updated 7 Aug 2024, 05:44 UTC.