Summary
[4.6.0-8.4]
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374)
- make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281)
[4.6.0-8.3]
- reintroduce ignore option -i as it is required for tests (RHEL-185328)
[4.6.0-8.2]
- backport documentation change for CVE-2023-52355 (RHEL-178281)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libtiff | 0:4.6.0-8.el10_2.4 |
| Oracle Linux · 10 | libtiff-devel | 0:4.6.0-8.el10_2.4 |
| Oracle Linux · 10 | libtiff-tools | 0:4.6.0-8.el10_2.4 |
Vulnerabilities 2
-
High 7.5
Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
-
High 7.3
Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specif…