Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

No

Technical impact

Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• libtiff Vendor— Affected before 4.6.0 Fixed in 4.6.0 Patch available CNA
• Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 4.6.0-8.el10_2.4 Patch available CNA
• Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 4.6.0-6.el10_0.4 Patch available CNA
• Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 4.4.0-15.el9 Patch available CNA
• Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 4.4.0-13.el9_6.5 Patch available CNA
• Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 3.2.2-1765379088 Patch available CNA
• Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 3.2.2-1765379049 Patch available CNA
• Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 3.2.2-1764871796 Patch available CNA
• Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 1772160593 Patch available CNA
• Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 1772160625 Patch available CNA
• Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 2.4.0-1763656152 Patch available CNA
• Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1790276886 Patch available CNA
• Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1790276884 Patch available CNA
• Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1790277045 Patch available CNA
• Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1790276889 Patch available CNA
• Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1790276974 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703497 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703506 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703590 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703568 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703586 Patch available CNA
• Red Hat OpenShift AI 3.2 VendorRed Hat Affected — Fixed in 1790703494 Patch available CNA
• Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1790703542 Patch available CNA
• Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
• Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
• Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
• Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA

• Fix · CNA libtiff Fixed in 4.6.0

Records fixed by the same vendor advisory or release, as the CNA lists them.

• Advisory · 2024-01-25

  Red Hat AI Inference Server 3.2, Red Hat Discovery 2 and 7 more products — RHSA-2025:20801

  2 records · Highest priority Priority HIGH · 1 HIGH, 1 LOW

  Other records, highest priority first

  • TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of servicePriority HIGH 72
  Show all 2 records → Advisory →

1. 2026-10-02 Threatist record created from CVE-2023-52355
2. 2026-10-03 Alias added: GHSA-fh6j-mgh8-7prh

• TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
• TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
• TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
• TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
• TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
• TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0

• CVE-2023-52355 · CVE Program
• CVE-2023-52355 · NVD
• FIRST EPSS
• GHSA-fh6j-mgh8-7prh · GitHub Advisory Database · CC BY 4.0
• CVE-2023-52355 · Red Hat security data · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences