CVE-2023-3316

5.9 MEDIUM

Published: June 19, 2023 Modified: November 03, 2025

Description

A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://gitlab.com/libtiff/libtiff/-/issues/515

Source: reefs@jfrog.com

Exploit Patch Third Party Advisory

https://gitlab.com/libtiff/libtiff/-/merge_requests/468

Source: reefs@jfrog.com

Patch Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html

Source: reefs@jfrog.com

https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/

Source: reefs@jfrog.com

Exploit Third Party Advisory

https://gitlab.com/libtiff/libtiff/-/issues/515