CVE-2019-7663

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

• http://bugzilla.maptools.org/show_bug.cgi?id=2833Exploit, Issue Tracking, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.htmlMailing List, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00026.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-25
• https://usn.ubuntu.com/3906-1/Third Party Advisory
• https://usn.ubuntu.com/3906-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4670
• http://bugzilla.maptools.org/show_bug.cgi?id=2833Exploit, Issue Tracking, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.htmlMailing List, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/02/msg00026.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-25
• https://usn.ubuntu.com/3906-1/Third Party Advisory
• https://usn.ubuntu.com/3906-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4670

Published

Feb 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7655Wowza Streaming Engine 4.8.0 and earlier from multiple authe…5.4
• CVE-2019-7656A privilege escalation vulnerability in Wowza Streaming Engi…7.8
• CVE-2019-7659Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers…
• CVE-2019-7660An issue was discovered in PHPMyWind 5.5. The username param…
• CVE-2019-7661An issue was discovered in PHPMyWind 5.5. The method paramet…
• CVE-2019-7662An assertion failure was discovered in wasm::WasmBinaryBuild…6.5
• CVE-2019-7664In elfutils 0.175, a negative-sized memcpy is attempted in e…5.5
• CVE-2019-7665In elfutils 0.175, a heap-based buffer over-read was discove…5.5
• CVE-2019-7666Prima Systems FlexAir, Versions 2.3.38 and prior. The applic…8.8
• CVE-2019-7667Prima Systems FlexAir, Versions 2.3.38 and prior. The applic…9.8
• CVE-2019-7668Prima Systems FlexAir devices have Default Credentials.
• CVE-2019-7669Prima Systems FlexAir, Versions 2.3.38 and prior. Improper v…8.8