CVE-2023-41175: Libtiff: potential integer overflow in raw2tiff.c
First published: Mon Aug 28 2023(Updated: )
A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libtiff Libtiff | <4.6.0 | |
| Fedoraproject Fedora | ||
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| redhat/libtiff | <4.6.0 | 4.6.0 |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2023-41175
- https://bugzilla.redhat.com/show_bug.cgi?id=2235264
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2224971
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2237201
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2237202
- https://access.redhat.com/errata/RHSA-2024:2289
- https://www.ibm.com/support/pages/node/7177223 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-41175.
What is the title of the vulnerability?
The title of the vulnerability is 'A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c.'
What is the severity of CVE-2023-41175?
The severity of CVE-2023-41175 is medium with a CVSS score of 6.5.
How does CVE-2023-41175 affect libtiff?
CVE-2023-41175 affects libtiff versions up to, but not including, 4.6.0.
How can I fix CVE-2023-41175?
To fix CVE-2023-41175, you should update libtiff to version 4.6.0 or above.
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/severity
- agent/title
- agent/description
- agent/references
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-41175
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- collector/ibm-support
- source/IBM
- vendor/libtiff
- canonical/libtiff libtiff
- vendor/fedoraproject
- canonical/fedoraproject fedora
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0
- package-manager/redhat
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp4