---
title: "vadz libtiff vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/vadz/libtiff
type: product
description: "vadz libtiff has 125 published CVEs, 0 in CISA KEV and 64 with public exploits."
updated: 2023-05-09
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# vadz libtiff vulnerabilities

Vendor: [vadz](https://radicalnotion.ai/vendor/vadz)

- **Published CVEs:** 125
- **In CISA KEV:** 0
- **With a public exploit:** 64
- **With a patch:** 124
- **Average CVSS:** 7.2
- **First CVE:** 2013-09-28
- **Latest CVE:** 2023-05-09

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 9 |
| High | 56 |
| Medium | 60 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 27 |
| [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 24 |
| [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 16 |
| [CWE-369](https://radicalnotion.ai/cwe/cwe-369) | Divide By Zero | 12 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 11 |
| [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 8 |
| [CWE-772](https://radicalnotion.ai/cwe/cwe-772) | Missing Release of Resource after Effective Lifetime | 7 |
| [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 4 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2013 | 1 |
| 2014 | 0 |
| 2015 | 0 |
| 2016 | 26 |
| 2017 | 58 |
| 2018 | 21 |
| 2019 | 1 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 16 |
| 2023 | 2 |

## Affected versions (top 28 of 108)

| Version | Kind | CVEs |
| --- | --- | --- |
| Pre360 | exact | 121 |
| Release- | exact | 121 |
| Release-v3-5- | exact | 121 |
| Release-v3-5-4 | exact | 121 |
| Release-v3-5-5 | exact | 121 |
| Release-v3-5-7 | exact | 121 |
| Release-3-7-0 | exact | 104 |
| Release-v3-6-0 | exact | 104 |
| Release-v3-6-0beta2 | exact | 104 |
| Release-v3-6-1 | exact | 104 |
| Release-v3-7-0-alpha | exact | 104 |
| Release-v3-7-0beta | exact | 104 |
| \<= 8.0 | range | 19 |
| \<= 14.04 | range | 18 |
| \<= 16.04 | range | 18 |
| \<= 9.0 | range | 16 |
| \<= 18.04 | range | 11 |
| \<= 18.10 | range | 11 |
| \<= 10.0 | range | 8 |
| \<= 13.2 | range | 8 |
| \<= 11.0 | range | 6 |
| \<= 35 | range | 6 |
| \<= 7.0 | range | 6 |
| \<= 13.1 | range | 4 |
| 11.7 | patched | 1 |
| 12.6 | patched | 1 |
| 16.0 | patched | 1 |
| 9.0 | patched | 1 |

## CVEs (first 30 of 125, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2023-30086 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-4645 | - | medium | 6.8 | No | Yes | Yes |
| CVE-2022-1355 | - | medium | 6.1 | No | Yes | Yes |
| CVE-2022-2869 | - | medium | 5.5 | No | No | Yes |
| CVE-2022-2868 | - | medium | 5.5 | No | No | Yes |
| CVE-2022-2867 | - | medium | 5.5 | No | No | Yes |
| CVE-2022-34526 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2022-2058 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2022-2057 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2022-2056 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2022-1623 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-1622 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-0924 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-0909 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-0908 | - | high | 7.7 | No | Yes | Yes |
| CVE-2022-0907 | - | medium | 5.5 | No | Yes | Yes |
| CVE-2022-0891 | - | high | 7.1 | No | Yes | Yes |
| CVE-2022-0865 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2017-16232 | - | high | 7.5 | No | Yes | Yes |
| CVE-2018-19210 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2018-18661 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2018-18557 | - | high | 8.8 | No | Yes | Yes |
| CVE-2018-17795 | - | high | 8.8 | No | Yes | Yes |
| CVE-2018-17101 | - | high | 8.8 | No | No | Yes |
| CVE-2018-17100 | - | high | 8.8 | No | No | Yes |
| CVE-2018-17000 | - | medium | 6.5 | No | Yes | Yes |
| CVE-2018-16335 | - | high | 8.8 | No | No | Yes |
| CVE-2018-15209 | - | high | 8.8 | No | Yes | Yes |
| CVE-2018-12900 | - | high | 8.8 | No | Yes | Yes |
| CVE-2018-10963 | - | medium | 6.5 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does vadz libtiff have?

vadz libtiff has 125 published CVE records since 2013.

### How many vadz libtiff CVEs are in CISA KEV?

None of vadz libtiff's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for vadz libtiff vulnerabilities?

Yes — 64 of vadz libtiff's CVEs have a known public exploit.

### Which versions of vadz libtiff are affected?

108 distinct vadz libtiff versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in vadz libtiff CVEs?

vadz libtiff's CVEs most often map to these CWE weakness types: CWE-125 (Out-of-bounds Read), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write), CWE-369 (Divide By Zero).

### How many critical vadz libtiff vulnerabilities are there?

vadz libtiff has 9 critical and 56 high-severity CVEs.

### What is the average severity of vadz libtiff CVEs?

The average CVSS base score across vadz libtiff's scored CVEs is 7.2.

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/vadz/libtiff). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.