Medium ELSA-2023-0302 7 CVEs

Moderate: libtiff security update (Oracle Linux 9)

Published Jan 24, 2023 · Updated Jan 24, 2023

Ecosystem: Oracle Linux

Summary

[4.4.0-5]
- Bump release
- Resolves: CVE-2022-2953

[4.4.0-4]
- Resolves: CVE-2022-2519 CVE-2022-2520 CVE-2022-2521

[4.4.0-3]
- Fix CVE-2022-2056 CVE-2022-2057 CVE-2022-2058
- Resolves: #2106768

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 9	libtiff	0:4.4.0-5.el9_1
Oracle Linux · 9	libtiff-devel	0:4.4.0-5.el9_1
Oracle Linux · 9	libtiff-tools	0:4.4.0-5.el9_1

Vulnerabilities 7

Medium 5.5

CVE-2022-2056

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…

LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine

Jun 30, 2022
Medium 5.5

CVE-2022-2057

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…

LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine

Jun 30, 2022
Medium 5.5

CVE-2022-2058

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…

LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine

Jun 30, 2022
Medium 5.5

CVE-2022-2953

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a …

LibTIFF LibTIFF tiff tiff Debian Azure Linux Alpine

Aug 29, 2022
Unscored —

CVE-2022-2519

There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1

tiff tiff Debian Alpine

Aug 31, 2022
Unscored —

CVE-2022-2520

A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can …

tiff tiff Debian Alpine

Aug 31, 2022
Unscored —

CVE-2022-2521

It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 call…

tiff tiff Debian Alpine

Aug 31, 2022