Red Hat Security Advisory: libtiff security update

Fixed packages 9

Vulnerabilities 5

• Medium 6.5
  CVE-2023-3618

  Segmentation fault in fax3encode in libtiff/tif_fax3.c

  A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Jul 12, 2023
• Medium 6.5
  CVE-2023-40745

  Libtiff: integer overflow in tiffcp.c

  LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux
  Oct 5, 2023
• Medium 6.5
  CVE-2023-41175

  Libtiff: potential integer overflow in raw2tiff.c

  A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux
  Oct 5, 2023
• Low 3.3
  CVE-2023-6228

  Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c

  An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Wolfi
  Dec 18, 2023
• Unscored —
  CVE-2022-40090

  An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of servic…

  tiff tiff openjpeg2 Debian Ubuntu Azure Linux
  Aug 22, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215865
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2234970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235264
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235265
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240995
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2289.json
• report
  https://access.redhat.com/security/cve/CVE-2022-40090
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40090
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40090
• report
  https://access.redhat.com/security/cve/CVE-2023-3618
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3618
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3618
• article
  https://gitlab.com/libtiff/libtiff/-/issues/529
• report
  https://access.redhat.com/security/cve/CVE-2023-6228
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6228
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6228
• report
  https://access.redhat.com/security/cve/CVE-2023-40745
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-40745
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-40745
• report
  https://access.redhat.com/security/cve/CVE-2023-41175
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41175
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41175