CVE catalog

CVE-2019-14973

tiff: CVE-2019-14973

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.20% · Oct 25, 2026

_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantiffsid4.7.2-1fixed
Debiantiffforky4.7.2-1fixed
Debiantifftrixie4.7.0-3+deb13u3fixed
Debiantifftrixie-security4.7.0-3+deb13u3fixed
Debiantiffbookworm4.5.0-6+deb12u4fixed
Debiantiffbookworm-security4.5.0-6+deb12u4fixed
Alpinetiff3.104.0.10-r1fixed
Alpinetiff3.114.0.10-r1fixed
Alpinetiff3.124.0.10-r1fixed
Alpinetiff3.134.0.10-r1fixed
Alpinetiff3.144.0.10-r1fixed
Alpinetiff3.154.0.10-r1fixed
Alpinetiff3.164.0.10-r1fixed
Alpinetiff3.174.0.10-r1fixed
Alpinetiff3.184.0.10-r1fixed
Alpinetiff3.194.0.10-r1fixed
Alpinetiff3.204.0.10-r1fixed
Alpinetiff3.214.0.10-r1fixed
Alpinetiff3.224.0.10-r1fixed
Alpinetiff3.234.0.10-r1fixed
Alpinetiff3.244.0.10-r1fixed
Alpinetiff3.74.0.10-r1fixed
Alpinetiff3.84.0.10-r1fixed
Alpinetiff3.94.0.10-r1fixed
Ubuntutiffpro4.0.3-12.3ubuntu2vulnerable
Ubuntutiffpro4.0.5-1vulnerable
Ubuntutiffpro4.0.6-1vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.1vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.2vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.3vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.4vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.5vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.6vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.7vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm1vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm2vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm3vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm4vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm6vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm7vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm8vulnerable
Ubuntutiffpro4.0.6-1ubuntu0.8+esm9fixed
Ubuntutiff16.044.0.3-12.3ubuntu2vulnerable
Ubuntutiff16.044.0.5-1vulnerable
Ubuntutiff16.044.0.6-1vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.1vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.2vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.3vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.4vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.5vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.6vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.7fixed
Ubuntutiff18.044.0.8-5vulnerable
Ubuntutiff18.044.0.8-6vulnerable
Ubuntutiff18.044.0.9-1vulnerable
Ubuntutiff18.044.0.9-2vulnerable
Ubuntutiff18.044.0.9-3vulnerable
Ubuntutiff18.044.0.9-4vulnerable
Ubuntutiff18.044.0.9-4ubuntu1vulnerable
Ubuntutiff18.044.0.9-5vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.1vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.2vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.3fixed
Ubuntutiffpro4.0.2-4ubuntu3vulnerable
Ubuntutiffpro4.0.3-5ubuntu1vulnerable
Ubuntutiffpro4.0.3-6vulnerable
Ubuntutiffpro4.0.3-6ubuntu1vulnerable
Ubuntutiffpro4.0.3-7vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.1vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.2vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.3vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.4vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.6vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.7vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.8vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.9vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.10vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm1vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm2vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm3vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm4vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm5vulnerable
Ubuntutiffpro4.0.3-7ubuntu0.11+esm6fixed
Ubuntutiff16.044.0.3-12.3ubuntu2vulnerable
Ubuntutiff16.044.0.5-1vulnerable
Ubuntutiff16.044.0.6-1vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.1vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.2vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.3vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.4vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.5vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.6vulnerable
Ubuntutiff16.044.0.6-1ubuntu0.7fixed
Ubuntutiff18.044.0.8-5vulnerable
Ubuntutiff18.044.0.8-6vulnerable
Ubuntutiff18.044.0.9-1vulnerable
Ubuntutiff18.044.0.9-2vulnerable
Ubuntutiff18.044.0.9-3vulnerable
Ubuntutiff18.044.0.9-4vulnerable
Ubuntutiff18.044.0.9-4ubuntu1vulnerable
Ubuntutiff18.044.0.9-5vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.1vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.2vulnerable
Ubuntutiff18.044.0.9-5ubuntu0.3fixed
Susetifflinux enterprise module for basesystem 15 sp14.0.9-5.30.28fixed
Susetifflinux enterprise module for basesystem 15 sp24.0.9-5.30.28fixed
Susetifflinux enterprise module for desktop applications 15 sp14.0.9-5.30.28fixed
Susetifflinux enterprise module for desktop applications 15 sp24.0.9-5.30.28fixed
Susetifflinux enterprise module for package hub 15 sp14.0.9-5.30.28fixed
Susetifflinux enterprise module for package hub 15 sp24.0.9-5.30.28fixed
Opensusetiffleap 15.14.0.9-lp151.10.3.1fixed
Opensusetiffleap 15.24.0.9-lp152.11.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantiffsourcesid4.0.10+git190814-1lowNot reported[934780]
Debiantiffsourceforky4.0.10+git190814-1lowNot reported[934780]
Debiantiffsourcetrixie4.0.10+git190814-1lowNot reported[934780]
Debiantiffsourcebookworm4.0.10+git190814-1lowNot reported[934780]
Alpinetiffapk3.104.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.114.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.124.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.134.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.144.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.154.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.164.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.174.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.184.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.194.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.204.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.214.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.224.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.234.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.244.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.74.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.84.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Alpinetiffapk3.94.0.10-r1Not reportedALPINE-CVE-2019-14973Not reported
Ubuntutiffdebpro4.0.6-1ubuntu0.8+esm9Not reportedUSN-5841-1Not reported
Ubuntutiffdeb16.044.0.6-1ubuntu0.7Not reportedUSN-4158-1Not reported
Ubuntutiffdeb18.044.0.9-5ubuntu0.3Not reportedUSN-4158-1Not reported
Ubuntutiffdebpro4.0.3-7ubuntu0.11+esm6Not reportedUBUNTU-CVE-2019-14973Not reported
Ubuntutiffdeb16.044.0.6-1ubuntu0.7Not reportedUBUNTU-CVE-2019-14973Not reported
Ubuntutiffdeb18.044.0.9-5ubuntu0.3Not reportedUBUNTU-CVE-2019-14973Not reported
Susetiffrpmlinux enterprise module for basesystem 15 sp14.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Susetiffrpmlinux enterprise module for basesystem 15 sp24.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Susetiffrpmlinux enterprise module for desktop applications 15 sp14.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Susetiffrpmlinux enterprise module for desktop applications 15 sp24.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Susetiffrpmlinux enterprise module for package hub 15 sp14.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Susetiffrpmlinux enterprise module for package hub 15 sp24.0.9-5.30.28Not reportedSUSE-SU-2020:2744-1Not reported
Opensusetiffrpmleap 15.14.0.9-lp151.10.3.1Not reportedOPENSUSE-SU-2020:1840-1Not reported
Opensusetiffrpmleap 15.24.0.9-lp152.11.3.1Not reportedOPENSUSE-SU-2020:1561-1Not reported

[Debian bug #934780]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libtiff5-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • [libtiff6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • [libtiff-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • [libtiff-doc]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · all · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • [libtiff-tools]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

  • [libtiffxx6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · bookworm; dsa · tiff · debian · 12

[Debian 13 (Trixie)]

  • [libtiff5-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • [libtiff6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • [libtiff-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • [libtiff-doc]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · all · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · all · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · all · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · all · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • [libtiff-tools]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

  • [libtiffxx6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.7.0-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

    • 4.7.0-3+deb13u3 · arm64 · trixie-security

      Fixed · Fixed: 4.0.10+git190814-1

      dsa · tiff · debian · 13

Observed:

References