What is CVE-2023-52356?

CVE-2023-52356 is a high-severity vulnerability in Libtiff, classified under Heap-based Buffer Overflow. CVSS score: 7.5/10. Published 2024-01-25.

How severe is CVE-2023-52356?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2023-52356 known to be exploited?

10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Libtiff

CVE-2023-52356

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

Vulnerability class: Buffer Overflow

EPSS: 0.022 (80.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Libtiff
Red Hat Ai Inference Server 3.2 — versions 3.2.2-1765379049, 1772160593, sha256:54616c9f3e4d27120504b0b2020432ef3ff85286a50de7be842f05df0cfcd69e
Red Hat Ai Inference Server 3.3 — versions sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e, 1775749857, 1775680262
Red Hat Discovery 2 — versions sha256:310df392f638ef6eca1a26db024ae2cb617db5932f886d2acddc92fb7289e740, 2.4.0-1763656152
Red Hat Enterprise Linux 10 — versions 0:4.6.0-6.el10_1.2
Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:4.6.0-6.el10_0.2
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8 — versions 0:4.0.9-32.el8_10
Red Hat Enterprise Linux 9 — versions 0:4.4.0-15.el9

Weakness classification (CWE)

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)

Frequently asked questions

What is CVE-2023-52356?: CVE-2023-52356 is a high-severity vulnerability in Libtiff, classified under Heap-based Buffer Overflow. CVSS score: 7.5/10. Published 2024-01-25.
How severe is CVE-2023-52356?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2023-52356 known to be exploited?: 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.