CVE-2008-2327: libtiff

CVSS: 6.8v2.0MediumModified

AliasesRHSA-2008:0847RHSA-2008:0863DEBIAN-CVE-2008-2327+2 more

Published 27-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-2327 is a medium (CVSS 6.8) vulnerability in libtiff. EPSS estimates a 4.13% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

4.13%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:11461-1 RHSA-2008:0848

Timeline

27-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

4.13%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.13% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Redhat3 products

libtiff< 0:3.8.2-7.el5_2.2 | < 0:3.5.7-31.el2 | < 0:3.5.7-31.el3
libtiff-debuginfo< 0:3.8.2-7.el5_2.2 | < 0:3.5.7-31.el3
libtiff-devel< 0:3.8.2-7.el5_2.2 | < 0:3.5.7-31.el2 | < 0:3.5.7-31.el3

Debian1 product

tiff< 3.8.2-11 | < 3.8.2-10+lenny1 | < 3.8.2-7+etch1

Libtiff1 product

libtiff≤ 3.8.2 | 3.4 | 3.5.1 | 3.5.2 | 3.5.3 | 3.5.4 | 3.5.5 | 3.5.6 | 3.5.7 | 3.6.0 | 3.6.1 | 3.7.0 | 3.7.1 | 3.8.0 | 3.8.1

3 vendors · 5 products

References

57 links

sunsolve.sun.com/search/document.do?assetkey=1-26-265030-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/31670Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:184Vendor AdvisoryX Refsource MANDRIVA
lists.apple.com/archives/security-announce//2008/Nov/msg00001.htmlVendor AdvisoryX Refsource APPLE
www.securityfocus.com/archive/1/496033/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/31838Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugs.gentoo.org/show_bug.cgi?id=234080X Refsource CONFIRM
lists.apple.com/archives/security-announce//2008/Sep/msg00005.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/31982Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31698Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 57 references

www.redhat.com/archives/fedora-package-announce/2008-September/msg00121.htmlVendor AdvisoryX Refsource FEDORA
www.vupen.com/english/advisories/2008/2971VDB EntryX Refsource VUPENVendor Advisory
www.us-cert.gov/cas/techalerts/TA08-260A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.vupen.com/english/advisories/2008/2776VDB EntryX Refsource VUPENVendor Advisory
www.vmware.com/security/advisories/VMSA-2008-0017.htmlX Refsource MISC
www.redhat.com/support/errata/RHSA-2008-0863.htmlVendor AdvisoryX Refsource REDHAT
lists.apple.com/archives/security-announce/2008/Nov/msg00002.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/31623Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/2584VDB EntryX Refsource VUPENVendor Advisory
security-tracker.debian.net/tracker/CVE-2008-2327X Refsource CONFIRM
www.securitytracker.com/id?1020750VDB EntryX Refsource SECTRACK
www.securityfocus.com/archive/1/497962/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2008/3107VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/31610Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/30832VDB EntryX Refsource BID
security-tracker.debian.net/tracker/DTSA-160-1X Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11489VDB EntrySignatureX Refsource OVAL
lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.htmlVendor AdvisoryX Refsource SUSE
www.vupen.com/english/advisories/2008/3232VDB EntryX Refsource VUPEN
secunia.com/advisories/31882Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2008-0848.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/31668Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2009/2143VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/32706Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5514VDB EntrySignatureX Refsource OVAL
www.debian.org/security/2008/dsa-1632Vendor AdvisoryX Refsource DEBIANPatch
support.apple.com/kb/HT3318X Refsource CONFIRM
security-tracker.debian.net/tracker/DSA-1632-1X Refsource CONFIRM
support.apple.com/kb/HT3298X Refsource CONFIRM
www.ubuntu.com/usn/usn-639-1Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2008-0847.htmlVendor AdvisoryX Refsource REDHAT
support.apple.com/kb/HT3276X Refsource CONFIRM
www.vupen.com/english/advisories/2008/2438VDB EntryX Refsource VUPENVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=458674X Refsource CONFIRMREPORT
secunia.com/advisories/32756Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security.gentoo.org/glsa/glsa-200809-07.xmlVendor AdvisoryX Refsource GENTOO
www.redhat.com/archives/fedora-package-announce/2008-September/msg00102.htmlVendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2008:0847Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=460120REPORT
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0847.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-2327REPORT
www.cve.org/CVERecord?id=CVE-2008-2327Advisory
nvd.nist.gov/vuln/detail/CVE-2008-2327Advisory
access.redhat.com/errata/RHSA-2008:0863Advisory
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0863.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2008-2327Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities