Most recent entries from all

ALSA-2023:2340 — Moderate: libtiff security update

Affected: AlmaLinux:9: libtiff, AlmaLinux:9: libtiff-devel, AlmaLinux:9: libtiff-tools

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE-2022-3597) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c (CVE-2022-3598) * libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c (CVE-2022-3599) * libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c (CVE-2022-3626) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627) * libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970) * libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c (CVE-2022-4645) * libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value (CVE-2023-30774) * libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (CVE-2023-30775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-05401

Withdrawn: BELL-CVE-2022-4645 — CVE-2022-4645 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-1103

cnvd-2023-15744

EUVD-2026-227234

fkie_cve-2022-4645

LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.

GHSA-6fr2-gj2w-xgr6

gsd-2022-4645

msrc_CVE-2022-4645 — LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948 allowing attackers to cause a denial-of-service…

msrc_CVE-2022-4645

RHSA-2023:2340 — Red Hat Security Advisory: libtiff security update

libtiff: heap Buffer overflows in tiffcrop.c libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c libtiff: integer overflow in function TIFFReadRGBATileExt of the file libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c libtiff: Heap buffer overflow in tiffcp() at tiffcp.c libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c

UBUNTU-CVE-2022-4645

Affected: Ubuntu:Pro:14.04:LTS: tiff, Ubuntu:Pro:16.04:LTS: tiff, Ubuntu:18.04:LTS: tiff, Ubuntu:20.04:LTS: tiff, Ubuntu:22.04:LTS: tiff

WID-SEC-W-2023-0570 — libTIFF: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libTIFF ausnutzen, um einen Denial of Service Angriff durchzuführen.