CVE-2023-2908

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	Libtiff	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Fedora	Fedora	—
Fedora	Fedora	—
Fedora	Fedora	—
Fedora	Fedora	—

References

https://access.redhat.com/security/cve/CVE-2023-2908Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218830Issue Tracking, Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3fPatch, Vendor Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/479Exploit, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00034.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20230731-0004/Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-2908Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218830Issue Tracking, Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3fPatch, Vendor Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/479Exploit, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00034.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html
https://security.netapp.com/advisory/ntap-20230731-0004/Third Party Advisory

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290808.5Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom actio CVE-2023-290815.5A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally a CVE-2023-290847.2Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.CVE-2023-290857.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290867.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290877.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290887.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290897.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290910.0EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete f CVE-2023-290907.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290917.5An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos CVE-2023-290927.8An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding