CVE-2023-2908: libtiff NULL Pointer Dereference
Vulnerability summary
CVE-2023-2908 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in libtiff. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 30-06-2023PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- tiff< 4.5.0-6+deb12u2 | < 4.5.1~rc3-1
Libtiff1 product
- libtiff≤ 4.5.0
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.11+esm9 | < 4.0.6-1ubuntu0.8+esm12 | < 4.0.9-5ubuntu0.10+esm2 | < 4.1.0+git191117-2ubuntu0.20.04.9 | < 4.3.0-6ubuntu0.5
3 vendors · 3 products
References
12 links- gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3fREPORTPatchVendor Advisory
lists.debian.org/debian-lts-announce/2023/07/msg00034.htmlThird Party Advisory- security.netapp.com/advisory/ntap-20230731-0004/Third Party Advisory
