# CVE-2023-0804: libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security... CVE-2023-0804 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2023-0804, released February 13, 2023. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2023-0804 - Priority: Routine - CVSS: 6.1 (Moderate) - EPSS: 0.0043 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 13, 2023 ## Description The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libtiff RHEL 8 | 0:4.0.9-29.el8_8 | [RHSA-2023:5353](https://patchblox.com/security/data/fix/linux/rhsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff RHEL 9 | 0:4.4.0-8.el9_2 | [RHSA-2023:3711](https://patchblox.com/security/data/fix/linux/rhsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff almalinux 8 | 4.0.9-29.el8_8 | [ALSA-2023:5353](https://patchblox.com/security/data/fix/linux/alsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff almalinux 9 | 4.4.0-8.el9_2 | [ALSA-2023:3711](https://patchblox.com/security/data/fix/linux/alsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff ol 8 | 0:4.0.9-29.el8_8 | [ELSA-2023-5353](https://patchblox.com/security/data/fix/linux/elsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff ol 9 | 0:4.4.0-8.el9_2 | [ELSA-2023-3711](https://patchblox.com/security/data/fix/linux/elsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff rocky 8 | 0:4.0.9-29.el8_8 | [RLSA-2023:5353](https://patchblox.com/security/data/fix/linux/rlsa-2023-5353.md) | Oct 5, 2023 | | Linux | libtiff rocky 9 | 0:4.4.0-8.el9_2 | [RLSA-2023:3711](https://patchblox.com/security/data/fix/linux/rlsa-2023-3711.md) | Aug 31, 2023 | | Linux | libtiff-debuginfo amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff-debugsource amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff-devel RHEL 8 | 0:4.0.9-29.el8_8 | [RHSA-2023:5353](https://patchblox.com/security/data/fix/linux/rhsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-devel RHEL 9 | 0:4.4.0-8.el9_2 | [RHSA-2023:3711](https://patchblox.com/security/data/fix/linux/rhsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-devel almalinux 8 | 4.0.9-29.el8_8 | [ALSA-2023:5353](https://patchblox.com/security/data/fix/linux/alsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-devel almalinux 9 | 4.4.0-8.el9_2 | [ALSA-2023:3711](https://patchblox.com/security/data/fix/linux/alsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-devel amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff-devel ol 8 | 0:4.0.9-29.el8_8 | [ELSA-2023-5353](https://patchblox.com/security/data/fix/linux/elsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-devel ol 9 | 0:4.4.0-8.el9_2 | [ELSA-2023-3711](https://patchblox.com/security/data/fix/linux/elsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-opengl Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10 | [libtiff-opengl 4.0.9-5ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff-opengl-4.0.9-5ubuntu0.10.md) | Jun 21, 2023 | | Linux | libtiff-opengl Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.8 | [libtiff-opengl 4.1.0+git191117-2ubuntu0.20.04.8](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff-opengl-4.1.0-git191117-2ubuntu0.20.04.8.md) | Jun 21, 2023 | | Linux | libtiff-opengl Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.4 | [libtiff-opengl 4.3.0-6ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff-opengl-4.3.0-6ubuntu0.4.md) | Jun 21, 2023 | | Linux | libtiff-static amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff-tools RHEL 8 | 0:4.0.9-29.el8_8 | [RHSA-2023:5353](https://patchblox.com/security/data/fix/linux/rhsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-tools RHEL 9 | 0:4.4.0-8.el9_2 | [RHSA-2023:3711](https://patchblox.com/security/data/fix/linux/rhsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-tools Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10 | [libtiff-tools 4.0.9-5ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff-tools-4.0.9-5ubuntu0.10.md) | Jun 21, 2023 | | Linux | libtiff-tools Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.8 | [libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.8](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff-tools-4.1.0-git191117-2ubuntu0.20.04.8.md) | Jun 21, 2023 | | Linux | libtiff-tools Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.4 | [libtiff-tools 4.3.0-6ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff-tools-4.3.0-6ubuntu0.4.md) | Jun 21, 2023 | | Linux | libtiff-tools almalinux 8 | 4.0.9-29.el8_8 | [ALSA-2023:5353](https://patchblox.com/security/data/fix/linux/alsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-tools almalinux 9 | 4.4.0-8.el9_2 | [ALSA-2023:3711](https://patchblox.com/security/data/fix/linux/alsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-tools amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff-tools ol 8 | 0:4.0.9-29.el8_8 | [ELSA-2023-5353](https://patchblox.com/security/data/fix/linux/elsa-2023-5353.md) | Sep 26, 2023 | | Linux | libtiff-tools ol 9 | 0:4.4.0-8.el9_2 | [ELSA-2023-3711](https://patchblox.com/security/data/fix/linux/elsa-2023-3711.md) | Jun 21, 2023 | | Linux | libtiff-tools-debuginfo amzn 2023 | 4.4.0-4.amzn2023.0.5 | [ALAS2023-2023-230](https://patchblox.com/security/data/fix/linux/alas2023-2023-230.md) | Jun 21, 2023 | | Linux | libtiff5 Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10 | [libtiff5 4.0.9-5ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiff5-4.0.9-5ubuntu0.10.md) | Jun 21, 2023 | | Linux | libtiff5 Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.8 | [libtiff5 4.1.0+git191117-2ubuntu0.20.04.8](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiff5-4.1.0-git191117-2ubuntu0.20.04.8.md) | Jun 21, 2023 | | Linux | libtiff5 Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.4 | [libtiff5 4.3.0-6ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiff5-4.3.0-6ubuntu0.4.md) | Jun 21, 2023 | | Linux | libtiffxx5 Ubuntu 18.04.6 LTS (bionic) | 4.0.9-5ubuntu0.10 | [libtiffxx5 4.0.9-5ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtiffxx5-4.0.9-5ubuntu0.10.md) | Jun 21, 2023 | | Linux | libtiffxx5 Ubuntu 20.04 LTS (focal) | 4.1.0+git191117-2ubuntu0.20.04.8 | [libtiffxx5 4.1.0+git191117-2ubuntu0.20.04.8](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libtiffxx5-4.1.0-git191117-2ubuntu0.20.04.8.md) | Jun 21, 2023 | | Linux | libtiffxx5 Ubuntu 22.04.1 LTS (jammy) | 4.3.0-6ubuntu0.4 | [libtiffxx5 4.3.0-6ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libtiffxx5-4.3.0-6ubuntu0.4.md) | Jun 21, 2023 | | Linux | tiff Debian 12.15 (bookworm) | 4.5.0-5 | [DEBIAN-CVE-2023-0804](https://patchblox.com/security/data/fix/linux/debian-cve-2023-0804.md) | Feb 13, 2023 | | Linux | tiff Debian 13.5 (trixie) | 4.5.0-5 | [DEBIAN-CVE-2023-0804](https://patchblox.com/security/data/fix/linux/debian-cve-2023-0804.md) | Feb 13, 2023 | | Linux | tiff Debian 14 | 4.5.0-5 | [DEBIAN-CVE-2023-0804](https://patchblox.com/security/data/fix/linux/debian-cve-2023-0804.md) | Feb 13, 2023 | | Linux | tiff opensuse-leap 16.0 | 4.7.1-160000.2.1 | [OPENSUSE-SU-2026:20995-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20995-1.md) | Jun 21, 2026 | | Linux | tiff sles 16.0 | 4.7.1-160000.2.1 | [SUSE-SU-2026:22306-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22306-1.md) | Jun 21, 2026 | | Linux | tiff-man opensuse-leap 16.0 | 4.7.1-160000.2.1 | [OPENSUSE-SU-2026:20995-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20995-1.md) | Jun 21, 2026 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo