RHSA-2023:3711: Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.Security Fix(es): libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795) libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796) libtiff: out-of-bounds read in TIFFmemcpy() in libtiff/tifunix.c when called by functions in tools/tiffcrop.c (CVE-2023-0797) libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798) libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799) libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) libtiff: out-of-bounds write in TIFFmemcpy() in libtiff/tifunix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What security issues are addressed in RHSA-2023:3711?
RHSA-2023:3711 addresses a heap-based buffer overflow in processCropSelections() and an out-of-bounds read in libtiff.
What is the severity of RHSA-2023:3711?
The severity of RHSA-2023:3711 is classified as important due to potential exploitability.
How do I fix RHSA-2023:3711?
To fix RHSA-2023:3711, update the libtiff package to version 4.4.0-8.el9_2 or later.
Which versions of libtiff are affected by RHSA-2023:3711?
All versions of libtiff prior to 4.4.0-8.el9_2 are affected by RHSA-2023:3711.
Is there a workaround for RHSA-2023:3711 until I can apply the update?
There is no known workaround for RHSA-2023:3711; applying the update is the recommended action.