CVE-2023-3316

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3316
A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gitlab.com/libtiff/libtiff/-/issues/515 Exploit Patch Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/468 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ Exploit Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/issues/515 Exploit Patch Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/468 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:16

Type Values Removed Values Added
Summary (en) A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. (en) A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.

21 Nov 2024, 08:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 5.9
References () https://gitlab.com/libtiff/libtiff/-/issues/515 - Exploit, Patch, Third Party Advisory () https://gitlab.com/libtiff/libtiff/-/issues/515 - Exploit, Patch, Third Party Advisory
References () https://gitlab.com/libtiff/libtiff/-/merge_requests/468 - Patch, Third Party Advisory () https://gitlab.com/libtiff/libtiff/-/merge_requests/468 - Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html - () https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html -
References () https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ - Exploit, Third Party Advisory () https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ - Exploit, Third Party Advisory

01 Aug 2023, 02:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html -

03 Jul 2023, 16:43

Type Values Removed Values Added
References
  • (MISC) https://gitlab.com/libtiff/libtiff/-/merge_requests/468 - Patch, Third Party Advisory
  • (MISC) https://gitlab.com/libtiff/libtiff/-/issues/515 - Exploit, Patch, Third Party Advisory
References (MISC) https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ - (MISC) https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-476
CPE cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

19 Jun 2023, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-19 12:15

Updated : 2025-02-13 17:16

NVD link : CVE-2023-3316

Mitre link : CVE-2023-3316

CVE.ORG link : CVE-2023-3316

JSON object : View

Products Affected

libtiff

  • libtiff
CWE
CWE-476

NULL Pointer Dereference