CVE-2023-25434 - Vulnerability Details - OpenCVE

Description

libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.

Published: 2023-06-14

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:libtiff:libtiff:4.5.0:-:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-29389	libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://gitlab.com/libtiff/libtiff/-/issues/519
https://nvd.nist.gov/vuln/detail/CVE-2023-25434
https://www.cve.org/CVERecord?id=CVE-2023-25434

History

Mon, 06 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Subscriptions

Libtiff Libtiff

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-06-14T00:00:00.000Z

Updated: 2025-01-06T16:20:00.419Z

Reserved: 2023-02-06T00:00:00.000Z

Link: CVE-2023-25434

Vulnrichment

Updated: 2024-08-02T11:18:36.345Z

NVD

Status : Modified

Published: 2023-06-14T20:15:09.337

Modified: 2025-01-06T17:15:11.303

Link: CVE-2023-25434

Redhat

Severity : Moderate

Publid Date: 2023-06-14T00:00:00Z

Links: CVE-2023-25434 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

{"bugzilla": {"description": "libtiff: heap-buffer overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c", "id": "2215209", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215209"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-119", "details": ["libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.", "A heap-based buffer overflow vulnerability was found in LibTIFF's tiffcrop utility in the extractContigSamplesBytes() function. This flaw allows an attacker to pass a crafted TIFF image file to the tiffcrop utility, which causes an out-of-bounds read access resulting in an application crash, eventually leading to a denial of service."], "name": "CVE-2023-25434", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "compat-libtiff3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "compat-libtiff3", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libtiff", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2023-06-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-25434\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-25434"], "statement": "This vulnerability in tiffcrop is classified as moderate severity rather than important because, while it leads to a denial of service (DoS) via a crash, the impact is not critical in terms of system compromise or data loss. The vulnerability, caused by a heap-based buffer overflow, results in an out-of-bounds read, which disrupts the functionality of the tiffcrop utility but does not allow an attacker to execute arbitrary code or escalate privileges. Additionally, exploitation requires the attacker to provide a specially crafted TIFF file, meaning it is not easily triggered remotely without user interaction. While it poses a disruption to operations, it does not lead to broader system vulnerabilities or compromise, justifying its classification as moderate severity.\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nSecure baseline configurations provide a strong foundation for maintaining a secure and resilient environment. Rigorous testing and development practices (SAST, DAST, etc.) identify and address memory vulnerabilities before they are promoted to Red Hat production platforms, and the malicious code protection used further mitigates impacts by detecting, blocking, and responding to exploitation attempts. The platform uses OS versions that inherit certain security tools and features from RHEL that are enabled by default, such as SELinux and Address Space Layout Randomization (ASLR). Least functionality and process isolation minimizes the attack surface by disabling unauthorized services and ports and containing any corruption within the originating process, preventing it from affecting other processes or the system as a whole.", "threat_severity": "Moderate"}