Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libtiff | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libtiff-debuginfo | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libtiff-debugsource | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libtiff-devel | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libtiff-tools-debuginfo | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | libtiff-debuginfo | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | libtiff-debugsource | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | libtiff-tools | 0:4.0.9-32.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | libtiff-tools-debuginfo | 0:4.0.9-32.el8_10 |
Vulnerabilities 4
-
High 7.5CVE-2023-52356 Public exploit
Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
-
Low 3.3
Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c
An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.
-
Unscored —
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (h…
-
Unscored —
libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size af…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1614051
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2218744
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2240995
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2251344
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5079.json
-
report
https://access.redhat.com/security/cve/CVE-2018-15209
-
advisory
https://www.cve.org/CVERecord?id=CVE-2018-15209
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-15209
-
report
https://access.redhat.com/security/cve/CVE-2023-6228
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-6228
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-6228
-
report
https://access.redhat.com/security/cve/CVE-2023-25433
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-25433
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25433
-
report
https://access.redhat.com/security/cve/CVE-2023-52356
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-52356
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-52356
-
article
https://gitlab.com/libtiff/libtiff/-/issues/622
-
article
https://gitlab.com/libtiff/libtiff/-/merge_requests/546