Moderate: libtiff security update
Summary
ALSA-2023:0095: Moderate: libtiff security update. Affects libtiff versions < 4.0.9-26.el8_7. Fixed in 4.0.9-26.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. It is widely used in various applications for image processing and manipulation. The vulnerability affects versions prior to 4.0.9-26.el8_7 in AlmaLinux 8.
Vulnerability Detail
The libtiff package is affected by multiple vulnerabilities:
-
CVE-2022-2056, CVE-2022-2057, CVE-2022-2058: These vulnerabilities can lead to a denial-of-service (DoS) attack due to a divide by zero error.
-
CVE-2022-2519: A double free or corruption vulnerability in the rotateImage() function at tiffcrop.c can be exploited by an attacker to execute arbitrary code.
-
CVE-2022-2867: A uint32_t underflow vulnerability in tiffcrop.c can result in out-of-bounds read and write, potentially leading to arbitrary code execution.
-
CVE-2022-2869: Another uint32_t underflow vulnerability in tiffcrop.c, specifically in the extractContigSamples8bits() function, can lead to out-of-bounds read and write, potentially allowing an attacker to execute arbitrary code.
-
CVE-2022-2953: A heap-buffer-overflow vulnerability in the extractImageSection function in tiffcrop.c can be exploited to execute arbitrary code.
-
CVE-2022-2520: An assertion failure vulnerability in the rotateImage() function at tiffcrop.c can lead to a crash or potential code execution.
-
CVE-2022-2521: An invalid pointer free operation in the TIFFClose() function at tif_close.c can result in a crash or potential code execution.
-
CVE-2022-2868: An out-of-bounds read vulnerability in reverseSamples16bits() function can be triggered by providing invalid crop_width and/or crop_length values, potentially leading to information disclosure.
These vulnerabilities can have various impacts, including crashes, code execution, denial-of-service, and potential information disclosure.
How To Fix
Minimum fixed version
4.0.9-26.el8_7
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
The libtiff package is affected by multiple vulnerabilities that can lead to crashes, code execution, denial-of-service attacks, and potential information disclosure. It is crucial to update the libtiff package to the latest version to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libtiff →
FAQ
Libtiff is a library for manipulating Tagged Image File Format (TIFF) files. It provides various functions for reading, writing, and manipulating TIFF images.
These vulnerabilities can lead to crashes, code execution, denial-of-service attacks, and potential information disclosure.
You can check the version of the libtiff package installed on your system and compare it with the affected versions mentioned in the advisory. If your version is older, it is likely that your system is affected.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is always recommended to apply security updates to mitigate potential risks.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related CVEs, in the references section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
