Skip to content
OpenAdvisories
Medium ALAS2023-2023-314 2 CVEs

Moderate: libtiff security update (Amazon Linux 2023)

Published Aug 17, 2023 · Updated May 9, 2024

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3627: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. CVE-2022-3597: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libtiff 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-debuginfo 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-debugsource 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-devel 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-static 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-tools 0:4.4.0-4.amzn2023.0.11
Amazon Linux · 2023 libtiff-tools-debuginfo 0:4.4.0-4.amzn2023.0.11

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3597.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3627.html