Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent…

Description

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

Scores

EPSS (exploitation in 30 days)

4.2% · top 9.1% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 9.3.

Weakness

• n/a
• CWE-189 (opens in a new tab)All about CWE-189 and its CVEs

Affected products

• n/a

  • affected n/a

References (29)

• 35817 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 35866 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-7724 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2347 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 55821 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• FEDORA-2009-7775 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• ADV-2009-1870 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://www.ocert.org/advisories/ocert-2009-012.html (opens in a new tab)x_refsource_MISCx_transferred
• oval:org.mitre.oval:def:10988 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 1022539 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• ADV-2011-0621 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• USN-801-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 35811 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 35883 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• GLSA-201209-02 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 36194 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://bugzilla.maptools.org/show_bug.cgi?id=2079 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20090713 [oCERT-2009-012] libtiff tools integer overflows (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• MDVSA-2009:150 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• GLSA-200908-03 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• libtiff-rgb2ycbcr-tiff2rgba-bo(51688) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 35911 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• 55822 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• RHSA-2009:1159 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 35652 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• DSA-1835 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• MDVSA-2011:043 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 50726 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-2347](https://trackcve.app/badge/CVE-2009-2347.svg)](https://trackcve.app/cve/CVE-2009-2347)

Record last updated 7 Aug 2024, 05:44 UTC.