REDHAT-BUG-2142736: Medium severity LibTIFF libtiff vulnerability
Published Nov 15, 2022
·Updated
LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
References: https://gitlab.com/libtiff/libtiff/-/issues/413 https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3597.json
Affected Software
1 affected component
LibTIFF libtiff
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch 236b7191f04c60d09ee836ae13b50f812c841047
Event History
Nov 15, 2022
Data Sourced
via Red Hat·06:26 AM
DescriptionSeverityAffected Software