REDHAT-BUG-2122799: Low severity tiff vulnerability

Published Aug 30, 2022

Updated

It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tifclose.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input.

Upstream bug:

https://gitlab.com/libtiff/libtiff/-/issues/422

Upstream fix:

https://gitlab.com/libtiff/libtiff/-/mergerequests/378

Affected Software

1 affected component

LibTIFF libtiff

Event History

Aug 30, 2022

Data Sourced

via Red Hat·07:57 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2122799?

The severity of REDHAT-BUG-2122799 is categorized as high due to the potential for program crashes and denial of service.

How do I fix REDHAT-BUG-2122799?

To fix REDHAT-BUG-2122799, update libtiff to the latest stable version that includes the necessary patches.

What causes the vulnerability in REDHAT-BUG-2122799?

The vulnerability in REDHAT-BUG-2122799 is caused by an invalid pointer free operation in the TIFFClose() function.

Which software versions are affected by REDHAT-BUG-2122799?

Affected software versions of REDHAT-BUG-2122799 include libtiff 4.4.0rc1 and potentially earlier versions.

What is the potential impact of REDHAT-BUG-2122799?

The potential impact of REDHAT-BUG-2122799 includes arbitrary program crashes and denial of service when processing crafted input.