Red Hat Security Advisory

RHSA-2024:2289

libtiff security update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libtiff-4.4.0-12.el9, libtiff-devel-4.4.0-12.el9
Red Hat Enterprise Linux CRB (v. 9) libtiff-tools-4.4.0-12.el9

Fixes 5 records

TI-2022-18986 CVE-2022-40090 · GHSA-279f-f7v7-h5h8

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows…

MEDIUM 62

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00947 Published 2023-08-22 Partial fix CWE-835

TI-2023-21784 CVE-2023-41175 · GHSA-hjwh-g78g-5xvp

Libtiff: potential integer overflow in raw2tiff.c

LOW 33

A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01295 Published 2023-10-05 Partial fix · 4.6.0, 4.4.0-12.el9 CWE-190

TI-2023-21518 CVE-2023-40745 · GHSA-w737-xjxg-h9mw

Libtiff: integer overflow in tiffcp.c

LOW 32

LibTIFF is vulnerable to an integer overflow.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01411 Published 2023-10-05 Partial fix · 4.6.0, 4.4.0-12.el9 CWE-190

TI-2023-03377 CVE-2023-3618 · GHSA-jgp5-27vm-42q7

Segmentation fault in fax3encode in libtiff/tif_fax3.c

LOW 31

A flaw was found in libtiff.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01188 Published 2023-07-12 Partial fix CWE-120

TI-2023-05719 CVE-2023-6228 · GHSA-4v5g-xjvw-59g6

Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c

LOW 25

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00399 Published 2023-12-18 Partial fix · 4.0.9-32.el8_10, 4.4.0-12.el9 CWE-787