Moderate: libtiff security update
Summary
ALSA-2022:7585: Moderate: libtiff security update. Affects libtiff versions < 4.0.9-23.el8. Fixed in 4.0.9-23.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. It is commonly used for reading, writing, and manipulating TIFF image files. The library provides various features and APIs for working with TIFF files, including support for different compression schemes, color spaces, and image metadata. However, several vulnerabilities have been discovered in libtiff that could potentially be exploited by attackers to cause denial of service or execute arbitrary code.
Vulnerability Detail
The libtiff vulnerabilities include:
- CVE-2022-0561: A crafted TIFF file can trigger a denial of service vulnerability.
- CVE-2022-0562: A null source pointer can lead to a denial of service vulnerability.
- CVE-2022-0865: A reachable assertion vulnerability.
- CVE-2022-0924: An out-of-bounds read error in tiffcp.
- CVE-2022-1355: A stack buffer overflow in tiffcp.c in main().
- CVE-2022-22844: An out-of-bounds read in _TIFFmemcpy() in tif_unix.c.
- CVE-2022-0891: A heap buffer overflow in extractImageSection.
- CVE-2022-0908: A null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c.
- CVE-2022-0909: A divide by zero error in tiffcrop.
These vulnerabilities can be exploited by specially crafted TIFF files, leading to denial of service or potential arbitrary code execution. The impact of these vulnerabilities can vary depending on the context in which libtiff is used.
How To Fix
Minimum fixed version
4.0.9-23.el8
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
The libtiff vulnerabilities can be serious, potentially leading to denial of service or arbitrary code execution. It is important to update the libtiff packages to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libtiff →
FAQ
Libtiff is a library for manipulating Tagged Image File Format (TIFF) files. It provides functions and APIs for reading, writing, and manipulating TIFF image files.
These vulnerabilities can lead to denial of service or potential arbitrary code execution, depending on the context in which libtiff is used.
To fix these vulnerabilities, update the libtiff packages to version 4.0.9-23.el8 or later using the package manager update command specific to your operating system.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
