Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3164: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. CVE-2022-0891: A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact CVE-2020-18768: There exists one heap buffer overflow in _TIFFmemcpy in tif_unix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libtiff | 0:4.0.3-35.amzn2.0.19 |
| Amazon Linux · 2 | libtiff-debuginfo | 0:4.0.3-35.amzn2.0.19 |
| Amazon Linux · 2 | libtiff-devel | 0:4.0.3-35.amzn2.0.19 |
| Amazon Linux · 2 | libtiff-static | 0:4.0.3-35.amzn2.0.19 |
| Amazon Linux · 2 | libtiff-tools | 0:4.0.3-35.amzn2.0.19 |
Vulnerabilities 3
-
Medium 6.1CVE-2022-0891 Public exploit
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker t…
-
Medium 5.5
Heap-buffer-overflow in extractimagesection()
A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.
-
Unscored —
There exists one heap buffer overflow in _TIFFmemcpy in tif_unix.c in libtiff 4.0.10, which allows an attacker to cause…