CVE-2023-30086
Medium · 5.5CVSS
5.5
EPSS
0.3%
Published
May 9, 2023
CISA due date
—
Cloudanix analysis
There is not enough information available about this issue to understand what it affects or how serious it might be.
- Exploitation
- Other
- Attacker needs
- Other
- Complexity
- Theoretical
- Impact
- Other
- Component
- Other
- Class
- Other
- Remediation
- Other
- Effort
- Other
- Patch risk
- Other
What it actually does
Technical details of the flaw are unavailable due to missing description and affected products.
Why it matters to the business
Impact cannot be quantified given absent product data; low EPSS and non-KEV status after 1256 days indicate minimal observed risk.
How an attack unfolds
An exploit is publicly available but no specific attack method or threat actor context is provided in the input.
How to fix it
No fixed versions listed; monitor vendor advisories for any updates as none are derivable from input.
How to confirm the fix worked
Confirm exposure only after obtaining product and version information from authoritative sources.
Typical attack path
- Unknown due to lack of vulnerability details
How to detect it
No log sources or artifacts can be identified without a description or product context.
What your security team should do
- Obtain complete vulnerability details including description and affected products before prioritization
- Track EPSS trend stability and exploit availability for future reassessment
The record
Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | tiff | 0 | 4.2.0-1+deb11u3 |
| Debian:12 | tiff | 0 | 4.4.0-5 |
| Debian:13 | tiff | 0 | 4.4.0-5 |
| Debian:14 | tiff | 0 | 4.4.0-5 |
| Red Hat:enterprise_linux:9::appstream | libtiff | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::appstream | libtiff-debuginfo | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::appstream | libtiff-debugsource | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::appstream | libtiff-devel | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::appstream | libtiff-tools | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::appstream | libtiff-tools-debuginfo | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff-debuginfo | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff-debugsource | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff-devel | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff-tools | 0 | 0:4.4.0-7.el9 |
| Red Hat:enterprise_linux:9::crb | libtiff-tools-debuginfo | 0 | 0:4.4.0-7.el9 |
| Ubuntu:18.04:LTS | tiff | 0 | 4.0.9-5ubuntu0.8 |
| Ubuntu:20.04:LTS | tiff | 0 | 4.1.0+git191117-2ubuntu0.20.04.6 |
| Ubuntu:22.04:LTS | tiff | 0 | 4.3.0-6ubuntu0.2 |
| Ubuntu:Pro:14.04:LTS | tiff | 0 | 4.0.3-7ubuntu0.11+esm5 |
| Ubuntu:Pro:16.04:LTS | tiff | 0 | 4.0.6-1ubuntu0.8+esm7 |
| conan | libtiff | 4.0.7 | No fix |
Related vulnerabilities
- CVE-2023-52356 A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a… Also affects tiff
- CVE-2023-6277 An out-of-memory flaw was found in libtiff. Also affects tiff
- CVE-2023-3576 A memory leak flaw was found in Libtiff's tiffcrop utility. Also affects tiff
- CVE-2017-17095 tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of… Also affects tiff
- CVE-2014-8127 LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read… Also affects tiff
- CVE-2016-10266 LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error… Also affects tiff
- CVE-2016-3186 Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows… Also affects tiff
- CVE-2015-8665 tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service… Also affects tiff