TI-2010-02489 Aliases CVE-2010-2595 GHSA-wvcx-9365-9p2w

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not…

LOW 25CWE-20Published 2010-07-01 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: None · None · Partial
Fix status: Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."

Why it matters now

EPSS 0.02754 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 1 advisoryRed Hat: 7 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:libtiff:libtiff:3.9.0:::::::*	3.9.0	Vulnerable	libtiff
cpe:2.3:a:libtiff:libtiff:3.9.2:::::::*	3.9.2	Vulnerable	libtiff

cpe:2.3:a:libtiff:libtiff:3.9.0:*:*:*:*:*:*:* Versions 3.9.0 Vulnerable ·libtiff
cpe:2.3:a:libtiff:libtiff:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·libtiff

Remediation

Red Hat 1 advisory

RHSA-2010:0519 Released 2010-07-08 · Red Hat rating Important
libtiff security update
- Red Hat Enterprise Linux (v. 5 server) libtiff-3.8.2-7.el5_5.5, libtiff-3.8.2-7.el5_5.5.i386, libtiff-3.8.2-7.el5_5.5.ia64 +5
- Red Hat Enterprise Linux AS version 4 libtiff-3.6.1-12.el4_8.5, libtiff-3.6.1-12.el4_8.5.i386, libtiff-3.6.1-12.el4_8.5.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) libtiff-3.8.2-7.el5_5.5, libtiff-3.8.2-7.el5_5.5.i386, libtiff-devel-3.8.2-7.el5_5.5.i386
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libtiff-3.8.2-7.el5_5.5, libtiff-devel-3.8.2-7.el5_5.5, libtiff-devel-3.8.2-7.el5_5.5.i386
- Red Hat Enterprise Linux Desktop version 4 libtiff-3.6.1-12.el4_8.5, libtiff-3.6.1-12.el4_8.5.i386, libtiff-devel-3.6.1-12.el4_8.5 +1
- Red Hat Enterprise Linux ES version 4 libtiff-3.6.1-12.el4_8.5, libtiff-3.6.1-12.el4_8.5.i386, libtiff-3.6.1-12.el4_8.5.ia64 +3
- Red Hat Enterprise Linux WS version 4 libtiff-3.6.1-12.el4_8.5, libtiff-3.6.1-12.el4_8.5.i386, libtiff-3.6.1-12.el4_8.5.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix yet
Red Hat Enterprise Linux (v. 5 server)	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux AS version 4	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux Desktop (v. 5 client)	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux Desktop version 4	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux ES version 4	Fixed	RHSA-2010:0519
Red Hat Enterprise Linux WS version 4	Fixed	RHSA-2010:0519

Timeline

2026-10-02 Threatist record created from CVE-2010-2595
2026-10-03 Alias added: GHSA-wvcx-9365-9p2w

References

Exploit 1

https://bugzilla.redhat.com/show_bug.cgi?id=583081

Advisory 3

Other 4

TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service CVSS 3.1HIGH 7.5
TI-2023-10746 libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. CVSS 3.1HIGH 8.8
TI-2022-03639 LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow CVSS 3.1HIGH 8.8
TI-2023-05765 Libtiff: out-of-memory in tiffopen via a craft file CVSS 3.1MEDIUM 6.5
TI-2022-03286 Out-of-bounds write in libtiff CVSS 3.1HIGH 7.7
TI-2006-03352 Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used… CVSS 2.0HIGH 7.5

See all 261 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences