A libtiff security update has been released for AlmaLinux 8.
ALSA-2023:0095 Moderate: libtiff security update
Type:
security
Severity:
moderate
Release date:
2023-01-13
Description
Security Fix(es):
* LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)
* libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519)
* libtiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c (CVE-2022-2867)
* libtiff: tiffcrop.c has uint32_t underflow which leads to out of bounds read and write in extractContigSamples8bits() (CVE-2022-2869)
* libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953)
* libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520)
* libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521)
* libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits() (CVE-2022-2868)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
RHSA-2023:0095
CVE-2022-2056
CVE-2022-2057
CVE-2022-2058
CVE-2022-2519
CVE-2022-2520
CVE-2022-2521
CVE-2022-2867
CVE-2022-2868
CVE-2022-2869
CVE-2022-2953
ALSA-2023:0095
Updates packages:
libtiff-devel-4.0.9-26.el8_7.i686.rpm
libtiff-4.0.9-26.el8_7.i686.rpm
libtiff-tools-4.0.9-26.el8_7.aarch64.rpm
libtiff-tools-4.0.9-26.el8_7.x86_64.rpm
libtiff-4.0.9-26.el8_7.aarch64.rpm
libtiff-devel-4.0.9-26.el8_7.aarch64.rpm
libtiff-4.0.9-26.el8_7.x86_64.rpm
libtiff-devel-4.0.9-26.el8_7.x86_64.rpm
libtiff-tools-4.0.9-26.el8_7.s390x.rpm
libtiff-tools-4.0.9-26.el8_7.ppc64le.rpm
libtiff-4.0.9-26.el8_7.ppc64le.rpm
libtiff-devel-4.0.9-26.el8_7.ppc64le.rpm
libtiff-devel-4.0.9-26.el8_7.s390x.rpm
libtiff-4.0.9-26.el8_7.s390x.rpm
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
