Red Hat Security AdvisoryRHSA-2023:0095
libtiff security update
Released 2023-01-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) libtiff-tools-4.0.9-26.el8_7
- Red Hat Enterprise Linux AppStream (v. 8) libtiff-4.0.9-26.el8_7, libtiff-devel-4.0.9-26.el8_7
Fixes 10 records
Priority LOW 32
It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted i…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01329 · Published 2022-08-31 · Partial fix CWE-763
Priority LOW 32
There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01329 · Published 2022-08-31 · Partial fix CWE-415
Priority LOW 32
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01322 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 31
A flaw was found in libtiff 4.4.0rc1.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01267 · Published 2022-08-31 · Partial fix CWE-131
Priority LOW 31
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0127 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 31
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0127 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 26
LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00575 · Published 2022-08-29 · Partial fix CWE-125
Priority LOW 25
libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00323 · Published 2022-08-17 · Partial fix CWE-191
Priority LOW 25
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0032 · Published 2022-08-17 · Partial fix CWE-20
Priority LOW 25
libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0032 · Published 2022-08-17 · Partial fix CWE-191
THREATIST.IORead the docs