Red Hat Security AdvisoryRHSA-2020:3902
libtiff security update
Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libtiff-4.0.3-35.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libtiff-devel-4.0.3-35.el7, libtiff-static-4.0.3-35.el7, libtiff-tools-4.0.3-35.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libtiff-4.0.3-35.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libtiff-devel-4.0.3-35.el7, libtiff-static-4.0.3-35.el7, libtiff-tools-4.0.3-35.el7
- Red Hat Enterprise Linux Server (v. 7) libtiff-4.0.3-35.el7, libtiff-4.0.3-35.el7.ppc, libtiff-devel-4.0.3-35.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) libtiff-static-4.0.3-35.el7, libtiff-static-4.0.3-35.el7.ppc, libtiff-tools-4.0.3-35.el7
- Red Hat Enterprise Linux Workstation (v. 7) libtiff-4.0.3-35.el7, libtiff-devel-4.0.3-35.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) libtiff-static-4.0.3-35.el7, libtiff-tools-4.0.3-35.el7
Fixes 2 records
Priority MEDIUM 44
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-si…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03356 · Published 2019-10-14 · Partial fix CWE-190
Priority LOW 36
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.04204 · Published 2019-08-14 · Partial fix CWE-190
