Red Hat Security Advisory: libtiff security update

Fixed packages 9

Vulnerabilities 11

• High 7.7
  CVE-2022-3570

  Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe…

  LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine
  Oct 21, 2022
• Medium 6.8
  CVE-2022-4645

  LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-servic…

  LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine
  Mar 3, 2023
• Medium 6.3
  CVE-2022-3970

  LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow

  A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit…

  tiff tiff tiff libtiff Debian Ubuntu Azure Linux Alpine
  Nov 13, 2022
• Medium 5.5
  CVE-2022-3597

  LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…

  LibTIFF LibTIFF tiff tiff Debian Azure Linux Alpine
  Oct 21, 2022
• Medium 5.5
  CVE-2022-3598

  LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attack…

  LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine
  Oct 21, 2022
• Medium 5.5
  CVE-2022-3599

  LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a d…

  LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine
  Oct 21, 2022
• Medium 5.5
  CVE-2022-3626

  LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelection…

  LibTIFF LibTIFF tiff tiff Debian Azure Linux Alpine
  Oct 21, 2022
• Medium 5.5
  CVE-2022-3627

  LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…

  LibTIFF LibTIFF tiff tiff Debian Azure Linux Alpine
  Oct 21, 2022
• Medium 5.5
  CVE-2023-30086

  Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tif…

  tiff tiff openjpeg2 Debian Ubuntu Azure Linux
  May 9, 2023
• Medium 5.5
  CVE-2023-30775

  A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamp…

  tiff tiff Debian Ubuntu
  May 19, 2023
• Unscored —
  CVE-2023-30774

  A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAME…

  tiff tiff openjpeg2 Debian Ubuntu Azure Linux
  May 19, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142734
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142736
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142738
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142740
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142741
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2142742
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2148918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176220
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187141
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2340.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3570
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3570
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3570
• report
  https://access.redhat.com/security/cve/CVE-2022-3597
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3597
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3597
• report
  https://access.redhat.com/security/cve/CVE-2022-3598
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3598
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3598
• report
  https://access.redhat.com/security/cve/CVE-2022-3599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3599
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3599
• report
  https://access.redhat.com/security/cve/CVE-2022-3626
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3626
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3626
• report
  https://access.redhat.com/security/cve/CVE-2022-3627
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3627
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3627
• report
  https://access.redhat.com/security/cve/CVE-2022-3970
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3970
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3970
• report
  https://access.redhat.com/security/cve/CVE-2022-4645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4645
• report
  https://access.redhat.com/security/cve/CVE-2023-30086
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2203650