CVE-2023-52356: Out-of-bounds Write

January 25, 2024 (updated January 31, 2024)

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

References

access.redhat.com/security/cve/CVE-2023-52356
bugzilla.redhat.com/show_bug.cgi?id=2251344
gitlab.com/libtiff/libtiff/-/issues/622
gitlab.com/libtiff/libtiff/-/merge_requests/546
nvd.nist.gov/vuln/detail/CVE-2023-52356

Code Behaviors & Features

Detect and mitigate CVE-2023-52356 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →