CVE-2023-0797: Medium severity ibm cognos analytics vulnerability
LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tifunix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a segmentation fault when processing TIFF files in TIFFmemcpy in tools/tifunix.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could overflow a buffer and cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-0797?
CVE-2023-0797 is a vulnerability in LibTIFF 4.4.0 that allows attackers to cause a denial-of-service via a crafted tiff file.
How severe is CVE-2023-0797?
CVE-2023-0797 has a severity level of medium.
How can I fix CVE-2023-0797?
If you compile libtiff from sources, the fix is available with commit afaabc3e.
What versions of LibTIFF are affected by CVE-2023-0797?
LibTIFF versions 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, and 4.5.1+git230720-1 are affected by CVE-2023-0797.
Where can I find more information about CVE-2023-0797?
You can find more information about CVE-2023-0797 at the following references: [reference 1](https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68), [reference 2](https://gitlab.com/libtiff/libtiff/-/issues/495), [reference 3](https://security-tracker.debian.org/tracker/CVE-2023-0797).