Moderate: libtiff security update
Summary
ALSA-2023:6575: Moderate: libtiff security update. Affects libtiff versions < 4.4.0-10.el9. Fixed in 4.4.0-10.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. It is widely used for image processing and is included in various software applications.
Vulnerability Detail
The libtiff library is affected by multiple vulnerabilities:
-
CVE-2023-2731: A null pointer dereference in LZWDecode() function in libtiff/tif_lzw.c can lead to a crash or potential code execution.
-
CVE-2023-3316: The tiffcrop utility is vulnerable to a null pointer dereference in TIFFClose() function, which can result in a crash.
-
CVE-2023-3576: The tiffcrop utility has a memory leak in tiffcrop.c, which can lead to resource exhaustion.
-
CVE-2023-26965: The loadImage() function in tiffcrop.c is susceptible to a heap-based use after free vulnerability when processing a crafted TIFF image, potentially leading to code execution.
-
CVE-2023-26966: The uv_encode() function in libtiff is affected by a buffer overflow vulnerability, which can be exploited for arbitrary code execution.
How To Fix
Minimum fixed version
4.4.0-10.el9
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Updating the libtiff packages to the latest version is crucial to mitigate the risks associated with these vulnerabilities. It is recommended to apply the security update as soon as possible. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libtiff →
FAQ
Libtiff is a library for manipulating TIFF files, commonly used for image processing.
These vulnerabilities can lead to crashes, resource exhaustion, and potential code execution.
There are no known public exploits for these vulnerabilities at the time of this advisory.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability.
You can refer to the CVE pages listed in the References section of the advisory for more detailed information.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
