Red Hat Security AdvisoryRHSA-2024:5079
libtiff security update
Released 2024-08-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) libtiff-4.0.9-32.el8_10, libtiff-devel-4.0.9-32.el8_10
- Red Hat Enterprise Linux CRB (v. 8) libtiff-tools-4.0.9-32.el8_10
Fixes 4 records
Priority HIGH 72
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02222 · Published 2024-01-25 · Partial fix · 4.6.0, 4.6.0-6.el10_1.2 +16 CWE-122
Priority MEDIUM 58
libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00411 · Published 2023-06-29 · Partial fix CWE-120
Priority MEDIUM 45
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a craf…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.03918 · Published 2018-08-08 · Fixed CWE-787
Priority LOW 25
An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00399 · Published 2023-12-18 · Partial fix · 4.0.9-32.el8_10, 4.4.0-12.el9 CWE-787
THREATIST.IORead the docs