Moderate: libtiff security update
Summary
ALSA-2024:5079: Moderate: libtiff security update. Affects libtiff versions < 4.0.9-32.el8_10. Fixed in 4.0.9-32.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. This vulnerability affects the libtiff package in AlmaLinux 8.
Vulnerability Detail
The libtiff package in AlmaLinux 8 is affected by multiple security vulnerabilities:
- Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)
- Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)
- Heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)
- Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)
These vulnerabilities can lead to various consequences, including remote code execution, denial of service, and potential unauthorized access to sensitive information.
How To Fix
Minimum fixed version
4.0.9-32.el8_10
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
The libtiff package in AlmaLinux 8 is affected by multiple security vulnerabilities. To mitigate these vulnerabilities, it is crucial to update the libtiff package to version 4.0.9-32.el8_10 or later. Failure to do so may result in remote code execution, denial of service, or unauthorized access to sensitive information.
See every vulnerability recorded for libtiff →
FAQ
libtiff is a library of functions for manipulating Tagged Image File Format (TIFF) files. It provides various tools and APIs for working with TIFF files.
These vulnerabilities can lead to remote code execution, denial of service, and potential unauthorized access to sensitive information.
No, only versions prior to 4.0.9-32.el8_10 are affected. It is recommended to update to the latest version to mitigate these vulnerabilities.
No, there are no known workarounds for these vulnerabilities. It is recommended to update the libtiff package to the latest version.
You can find more information about these vulnerabilities, including their CVE identifiers, in the References section of the CVE page(s) listed in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
