REDHAT-BUG-2122792: Low severity tiff vulnerability

Published Aug 30, 2022

Updated

A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.

Upstream bug:

https://gitlab.com/libtiff/libtiff/-/issues/424

Upstream fix:

https://gitlab.com/libtiff/libtiff/-/mergerequests/378

Affected Software

1 affected component

LibTIFF libtiff

Event History

Aug 30, 2022

Data Sourced

via Red Hat·07:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2122792?

The severity of REDHAT-BUG-2122792 is high due to potential program crashes when processing crafted TIFF images.

How do I fix REDHAT-BUG-2122792?

To fix REDHAT-BUG-2122792, upgrade to the patched version of libtiff that addresses the sysmalloc assertion failure.

What systems are affected by REDHAT-BUG-2122792?

REDHAT-BUG-2122792 affects systems using libtiff version 4.4.0rc1.

Is there a workaround for REDHAT-BUG-2122792?

Currently, there is no official workaround for REDHAT-BUG-2122792 besides upgrading to the fixed version.

How does REDHAT-BUG-2122792 exploit vulnerabilities in libtiff?

REDHAT-BUG-2122792 exploits vulnerabilities in libtiff by causing assertion failures in the rotateImage() function when handling specially crafted input.