Skip to content
OpenAdvisories
Medium RHSA-2023:2883 2 CVEs

Red Hat Security Advisory: libtiff security update

Published Sep 16, 2024 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream libtiff 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libtiff-debuginfo 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libtiff-debugsource 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libtiff-devel 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libtiff-tools-debuginfo 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::crb libtiff-debuginfo 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::crb libtiff-debugsource 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::crb libtiff-tools 0:4.0.9-27.el8
Red Hat · RHEL 8 enterprise_linux:8::crb libtiff-tools-debuginfo 0:4.0.9-27.el8

Vulnerabilities 2

  • Medium 6.3
    CVE-2022-3970

    LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow

    A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit…

    tiff tiff tiff libtiff Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2022-3627

    LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…

    LibTIFF LibTIFF tiff tiff Debian Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2142742
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2148918
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2883.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-3627
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-3627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-3627
  • report
    https://access.redhat.com/security/cve/CVE-2022-3970
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-3970
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-3970