{"api_version":"1","generated_at":"2026-04-22T19:08:00+00:00","cve":"CVE-2023-52356","urls":{"html":"https://cve.report/CVE-2023-52356","api":"https://cve.report/api/cve/CVE-2023-52356.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-52356","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-52356"},"summary":{"title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","description":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","state":"PUBLISHED","assigner":"redhat","published_at":"2024-01-25 20:15:39","updated_at":"2026-04-17 14:16:32"},"problem_types":["CWE-122","CWE-787","CWE-122 Heap-based Buffer Overflow"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"secalert@redhat.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://support.apple.com/kb/HT214124","name":"https://support.apple.com/kb/HT214124","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/23","name":"http://seclists.org/fulldisclosure/2024/Jul/23","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2024:5079","name":"https://access.redhat.com/errata/RHSA-2024:5079","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/16","name":"http://seclists.org/fulldisclosure/2024/Jul/16","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7081","name":"https://access.redhat.com/errata/RHSA-2026:7081","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214120","name":"https://support.apple.com/kb/HT214120","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","name":"https://access.redhat.com/errata/RHSA-2026:8747","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2025:23080","name":"https://access.redhat.com/errata/RHSA-2025:23080","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/17","name":"http://seclists.org/fulldisclosure/2024/Jul/17","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214118","name":"https://support.apple.com/kb/HT214118","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/22","name":"http://seclists.org/fulldisclosure/2024/Jul/22","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2025:23079","name":"https://access.redhat.com/errata/RHSA-2025:23079","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2023-52356","name":"https://access.redhat.com/security/cve/CVE-2023-52356","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"cve-details","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2025:21994","name":"https://access.redhat.com/errata/RHSA-2025:21994","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214122","name":"https://support.apple.com/kb/HT214122","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214117","name":"https://support.apple.com/kb/HT214117","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2025:23078","name":"https://access.redhat.com/errata/RHSA-2025:23078","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"2251344 – (CVE-2023-52356) CVE-2023-52356 libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546","name":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of col/row (fixes #622) (!546) · Merge requests · libtiff / libtiff · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2025:20801","name":"https://access.redhat.com/errata/RHSA-2025:20801","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","name":"https://access.redhat.com/errata/RHSA-2026:8748","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:3461","name":"https://access.redhat.com/errata/RHSA-2026:3461","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214116","name":"https://support.apple.com/kb/HT214116","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214123","name":"https://support.apple.com/kb/HT214123","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","name":"http://seclists.org/fulldisclosure/2024/Jul/20","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7304","name":"https://access.redhat.com/errata/RHSA-2026:7304","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","name":"http://seclists.org/fulldisclosure/2024/Jul/18","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT214119","name":"https://support.apple.com/kb/HT214119","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:3462","name":"https://access.redhat.com/errata/RHSA-2026:3462","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html","name":"https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7335","name":"https://access.redhat.com/errata/RHSA-2026:7335","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","name":"http://seclists.org/fulldisclosure/2024/Jul/19","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2024/Jul/21","name":"http://seclists.org/fulldisclosure/2024/Jul/21","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html","name":"https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:5958","name":"https://access.redhat.com/errata/RHSA-2026:5958","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","name":"https://access.redhat.com/errata/RHSA-2026:8746","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://gitlab.com/libtiff/libtiff/-/issues/622","name":"https://gitlab.com/libtiff/libtiff/-/issues/622","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"A SEGV found in TIFFReadRGBATileExt (#622) · Issues · libtiff / libtiff · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52356","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52356","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"unaffected 0:4.6.0-6.el10_1.2 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","version":"unaffected 0:4.6.0-6.el10_0.2 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"unaffected 0:4.0.9-32.el8_10 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"unaffected 0:4.4.0-15.el9 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","version":"unaffected 0:4.4.0-13.el9_6.3 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:bddcf7ab6d576572b6d60822c313ffebcd9869e4fde93e32ac327821f93cf32b * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:7856bdb7ae0d643a7b9362c164d4d4fe3c0c7186f5fff73a7ae9835b3df52e57 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:14e32e88f1b89f59ed34a6d712746b82a6a54c6ed4727784f18aeff853abbdc7 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:dcb9d1cd005c40b6db6f893e56419e383b9dcc0d38315605cb1457e2af5354f7 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","version":"unaffected sha256:54616c9f3e4d27120504b0b2020432ef3ff85286a50de7be842f05df0cfcd69e * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","version":"unaffected sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","version":"unaffected sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","version":"unaffected sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Discovery 2","version":"unaffected sha256:310df392f638ef6eca1a26db024ae2cb617db5932f886d2acddc92fb7289e740 * rpm","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2023-11-24T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2023-11-03T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"52356","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"libtiff","cpe5":"libtiff","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"52356","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"52356","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"52356","cve":"CVE-2023-52356","epss":"0.008490000","percentile":"0.748960000","score_date":"2026-04-21","updated_at":"2026-04-22 00:07:41"},"legacy_qids":[{"cve":"CVE-2023-52356","qid":"200123","title":"Ubuntu Security Notification for LibTIFF Vulnerabilities (USN-6644-1)"},{"cve":"CVE-2023-52356","qid":"200148","title":"Ubuntu Security Notification for LibTIFF Vulnerabilities (USN-6644-2)"},{"cve":"CVE-2023-52356","qid":"357235","title":"Amazon Linux Security Advisory for libtiff : ALAS2023-2024-525"},{"cve":"CVE-2023-52356","qid":"6000519","title":"Debian Security Update for tiff (DLA 3758-1)"},{"cve":"CVE-2023-52356","qid":"755820","title":"SUSE Enterprise Linux Security Update for tiff (SUSE-SU-2024:0594-1)"},{"cve":"CVE-2023-52356","qid":"755821","title":"SUSE Enterprise Linux Security Update for tiff (SUSE-SU-2024:0593-1)"},{"cve":"CVE-2023-52356","qid":"908006","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for libtiff (34077)"},{"cve":"CVE-2023-52356","qid":"908081","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for libtiff (34077-1)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T20:36:13.850Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2023-52356"},{"name":"RHBZ#2251344","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344"},{"tags":["x_transferred"],"url":"https://gitlab.com/libtiff/libtiff/-/issues/622"},{"tags":["x_transferred"],"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214119"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214123"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214122"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214117"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214118"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214116"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214120"},{"tags":["x_transferred"],"url":"https://support.apple.com/kb/HT214124"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/16"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/23"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/21"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/20"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/17"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/22"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/18"},{"tags":["x_transferred"],"url":"http://seclists.org/fulldisclosure/2024/Jul/19"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2023-52356","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-01-28T01:27:48.546657Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-06-17T21:19:29.445Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://gitlab.com/libtiff/libtiff","defaultStatus":"unaffected","packageName":"libtiff","versions":[{"lessThan":"4.6.0","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"],"defaultStatus":"affected","packageName":"libtiff","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.0-6.el10_1.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"libtiff","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.0-6.el10_0.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::crb","cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"libtiff","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.0.9-32.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"libtiff","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.0-15.el9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::crb","cpe:/a:redhat:rhel_eus:9.6::appstream"],"defaultStatus":"affected","packageName":"libtiff","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.0-13.el9_6.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:bddcf7ab6d576572b6d60822c313ffebcd9869e4fde93e32ac327821f93cf32b","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:7856bdb7ae0d643a7b9362c164d4d4fe3c0c7186f5fff73a7ae9835b3df52e57","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:14e32e88f1b89f59ed34a6d712746b82a6a54c6ed4727784f18aeff853abbdc7","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:dcb9d1cd005c40b6db6f893e56419e383b9dcc0d38315605cb1457e2af5354f7","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:54616c9f3e4d27120504b0b2020432ef3ff85286a50de7be842f05df0cfcd69e","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"sha256:310df392f638ef6eca1a26db024ae2cb617db5932f886d2acddc92fb7289e740","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"libtiff","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unknown","packageName":"compat-libtiff3","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unknown","packageName":"libtiff","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"compat-libtiff3","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"datePublic":"2023-11-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-17T13:33:12.074Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2024:5079","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:5079"},{"name":"RHSA-2025:20801","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:20801"},{"name":"RHSA-2025:21994","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:21994"},{"name":"RHSA-2025:23078","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:23078"},{"name":"RHSA-2025:23079","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:23079"},{"name":"RHSA-2025:23080","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:23080"},{"name":"RHSA-2026:3461","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"name":"RHSA-2026:3462","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"name":"RHSA-2026:5958","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:5958"},{"name":"RHSA-2026:7081","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7081"},{"name":"RHSA-2026:7304","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7304"},{"name":"RHSA-2026:7335","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7335"},{"name":"RHSA-2026:8746","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:8746"},{"name":"RHSA-2026:8747","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:8747"},{"name":"RHSA-2026:8748","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:8748"},{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2023-52356"},{"name":"RHBZ#2251344","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251344"},{"url":"https://gitlab.com/libtiff/libtiff/-/issues/622"},{"url":"https://gitlab.com/libtiff/libtiff/-/merge_requests/546"}],"timeline":[{"lang":"en","time":"2023-11-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-11-03T00:00:00.000Z","value":"Made public."}],"title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() leading to denial of service","x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-122: Heap-based Buffer Overflow"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2023-52356","datePublished":"2024-01-25T20:03:40.971Z","dateReserved":"2024-01-24T14:08:49.010Z","dateUpdated":"2026-04-17T13:33:12.074Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-01-25 20:15:39","lastModifiedDate":"2026-04-17 14:16:32","problem_types":["CWE-122","CWE-787","CWE-122 Heap-based Buffer Overflow"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD25C1-A304-486F-A36B-7167EEF33388"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"52356","Ordinal":"1","Title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() lead","CVE":"CVE-2023-52356","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"52356","Ordinal":"1","NoteData":"A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.","Type":"Description","Title":"Libtiff: segment fault in libtiff  in tiffreadrgbatileext() lead"}]}}}