Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3627: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. CVE-2022-3597: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libtiff | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-debuginfo | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-debugsource | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-devel | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-static | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-tools | 0:4.4.0-4.amzn2023.0.11 |
| Amazon Linux · 2023 | libtiff-tools-debuginfo | 0:4.4.0-4.amzn2023.0.11 |
Vulnerabilities 2
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…