Skip to content
OpenAdvisories
Medium ALAS2-2023-2263 4 CVEs

Moderate: libtiff security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Oct 18, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26965: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. CVE-2022-2058: A divide-by-zero vulnerability was found in libtiff. This flaw allows an attacker to cause a denial of service via a crafted tiff file. CVE-2022-2056: Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. CVE-2016-5321: The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libtiff 0:4.0.3-35.amzn2.0.14
Amazon Linux · 2 libtiff-debuginfo 0:4.0.3-35.amzn2.0.14
Amazon Linux · 2 libtiff-devel 0:4.0.3-35.amzn2.0.14
Amazon Linux · 2 libtiff-static 0:4.0.3-35.amzn2.0.14
Amazon Linux · 2 libtiff-tools 0:4.0.3-35.amzn2.0.14

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-5321.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-2056.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-2058.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26965.html