USN-6644-1: LibTIFF vulnerabilities
It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash, resulting in a denial of service. (CVE-2023-52356) It was discovered that LibTIFF incorrectly handled certain image files with the tiffcp utility. If a user were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause tiffcp to crash, resulting in a denial of service. (CVE-2023-6228) It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to consume resources, resulting in a denial of service. (CVE-2023-6277)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in 4.5.1+git230720-1ubuntu1.1 - Upgrade
Upgrade
ubuntu/libtiff6to a version that resolves this vulnerability.Fixed in 4.5.1+git230720-1ubuntu1.1 - Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2ubuntu0.20.04.12 - Upgrade
Upgrade
ubuntu/libtiff5to a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2ubuntu0.20.04.12 - Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/libtiff5to a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6644-1?
USN-6644-1 is considered a denial of service vulnerability due to improper handling of certain files by LibTIFF.
How do I fix USN-6644-1?
To fix USN-6644-1, upgrade LibTIFF to version 4.5.1+git230720-1ubuntu1.1 or later on affected Ubuntu versions.
Which packages are affected by USN-6644-1?
The affected packages in USN-6644-1 include libtiff-tools and libtiff6 for specific Ubuntu versions.
What can an attacker do with USN-6644-1?
An attacker can exploit USN-6644-1 by tricking users into opening specially crafted files, potentially causing application crashes.
Which Ubuntu versions are vulnerable to USN-6644-1?
Vulnerable versions for USN-6644-1 include Ubuntu 18.04, 20.04, and 23.10 with specific versions of LibTIFF.