Critical
Security advisory
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-5225
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:01 UTC · Revision 1
Source evidence
LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.
osv:CVE-2017-5225
Complete source record
{
"id": "9801f8bf01acfcabc0c200e9bb972c9b23cbb6a1f7472a3ab1e76d6a777cc9bc",
"url": "https://osv.dev/vulnerability/CVE-2017-5225",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-5225",
"summary": "LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.",
"evidence": "osv:CVE-2017-5225",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-5225",
"aliases": [
"CVE-2017-5225"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vadz/libtiff",
"type": "GIT",
"events": [
{
"introduced": "b28076b056eba9d665881bab139d21b21137fd2d"
},
{
"last_affected": "b28076b056eba9d665881bab139d21b21137fd2d"
},
{
"fixed": "5c080298d59efa53264d7248bbe3a04660db6ef7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libtiff:libtiff:4.0.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.7"
},
{
"last_affected": "4.0.7"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "5c080298d59efa53264d7248bbe3a04660db6ef7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.0.7",
"Release-v4-0-7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5225.json",
"vanir_signatures": [
{
"id": "CVE-2017-5225-4e09e5be",
"digest": {
"length": 6122,
"function_hash": "139757515412619317776256060797273960561"
},
"source": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7",
"target": {
"file": "tools/tiffcp.c",
"function": "tiffcp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-5225-56360e4e",
"digest": {
"length": 1011,
"function_hash": "168156336267725420381506114202630947193"
},
"source": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7",
"target": {
"file": "tools/tiffcp.c",
"function": "DECLAREcpFunc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-5225-da219ced",
"digest": {
"threshold": 0.9,
"line_hashes": [
"136248069597515547354886829352792017324",
"276184522356552445469833162815849296552",
"48733699451098292164688078749491633094",
"25400277086004514631513115314684551438",
"98582711887134687347867759195701524014",
"101824058636121926936295693400555351272",
"10611410785911493730315934183292050452",
"322599227046705245941446755801945879635",
"98582711887134687347867759195701524014",
"101824058636121926936295693400555351272",
"10611410785911493730315934183292050452",
"322599227046705245941446755801945879635",
"170271766192263683930282281212249681344",
"229697156173984413749737760831716949294",
"218489414069696955633694738271343607190",
"43264974078353853148923916561927878852"
]
},
"source": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7",
"target": {
"file": "tools/tiffcp.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-5225-fa060928",
"digest": {
"length": 1011,
"function_hash": "97221662646033453553265587060548636437"
},
"source": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7",
"target": {
"file": "tools/tiffcp.c",
"function": "DECLAREcpFunc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:03:21Z"
}
},
{
"ranges": [
{
"repo": "https://gitlab.com/libtiff/libtiff",
"type": "GIT",
"events": [
{
"introduced": "884f973652b8b020e533b1e340da3ef4bcd1d925"
},
{
"last_affected": "884f973652b8b020e533b1e340da3ef4bcd1d925"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libtiff:libtiff:4.0.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.7"
},
{
"last_affected": "4.0.7"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0.7",
"v4.0.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5225.json"
}
}
],
"modified": "2026-10-24T14:03:21.511888626Z",
"provider": "osv",
"references": [
"https://security.gentoo.org/glsa/201709-27",
"https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-5225",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442789,
"published_at": "2017-01-12T11:59:00.133+00:00"
}