Red Hat Security AdvisoryRHSA-2023:0302
libtiff security update
Released 2023-01-23 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 9) libtiff-tools-4.4.0-5.el9_1
- Red Hat Enterprise Linux AppStream (v. 9) libtiff-4.4.0-5.el9_1, libtiff-devel-4.4.0-5.el9_1
Fixes 7 records
Priority LOW 32
It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted i…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01329 · Published 2022-08-31 · Partial fix CWE-763
Priority LOW 32
There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01329 · Published 2022-08-31 · Partial fix CWE-415
Priority LOW 32
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01322 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 31
A flaw was found in libtiff 4.4.0rc1.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01267 · Published 2022-08-31 · Partial fix CWE-131
Priority LOW 31
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0127 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 31
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0127 · Published 2022-06-30 · Partial fix CWE-369
Priority LOW 26
LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00575 · Published 2022-08-29 · Partial fix CWE-125
THREATIST.IORead the docs