Description
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
Problem types
Product status
Any version before 4.6.0
0:4.6.0-6.el10_1.2 (rpm) before *
0:4.6.0-6.el10_0.2 (rpm) before *
0:4.0.9-32.el8_10 (rpm) before *
0:4.4.0-15.el9 (rpm) before *
0:4.4.0-13.el9_6.3 (rpm) before *
3.2.2-1765379088 (rpm) before *
3.2.2-1765379049 (rpm) before *
3.2.2-1764871796 (rpm) before *
1772160593 (rpm) before *
1772160625 (rpm) before *
1775740563 (rpm) before *
1778244546 (rpm) before *
1775680192 (rpm) before *
1775680262 (rpm) before *
1775749857 (rpm) before *
2.4.0-1763656152 (rpm) before *
Timeline
| 2023-11-24: | Reported to Red Hat. |
| 2023-11-03: | Made public. |
References
access.redhat.com/security/cve/CVE-2023-52356
bugzilla.redhat.com/show_bug.cgi?id=2251344 (RHBZ#2251344)
gitlab.com/libtiff/libtiff/-/issues/622
gitlab.com/libtiff/libtiff/-/merge_requests/546
lists.debian.org/debian-lts-announce/2024/03/msg00011.html
seclists.org/fulldisclosure/2024/Jul/16
seclists.org/fulldisclosure/2024/Jul/23
seclists.org/fulldisclosure/2024/Jul/21
seclists.org/fulldisclosure/2024/Jul/20
seclists.org/fulldisclosure/2024/Jul/17
seclists.org/fulldisclosure/2024/Jul/22
seclists.org/fulldisclosure/2024/Jul/18
seclists.org/fulldisclosure/2024/Jul/19
lists.debian.org/debian-lts-announce/2025/01/msg00019.html
access.redhat.com/errata/RHSA-2024:5079 (RHSA-2024:5079)
access.redhat.com/errata/RHSA-2025:20801 (RHSA-2025:20801)
access.redhat.com/errata/RHSA-2025:21994 (RHSA-2025:21994)
access.redhat.com/errata/RHSA-2025:23078 (RHSA-2025:23078)
access.redhat.com/errata/RHSA-2025:23079 (RHSA-2025:23079)
access.redhat.com/errata/RHSA-2025:23080 (RHSA-2025:23080)
access.redhat.com/errata/RHSA-2026:16174 (RHSA-2026:16174)
access.redhat.com/errata/RHSA-2026:3461 (RHSA-2026:3461)
access.redhat.com/errata/RHSA-2026:3462 (RHSA-2026:3462)
access.redhat.com/errata/RHSA-2026:5958 (RHSA-2026:5958)
access.redhat.com/errata/RHSA-2026:7081 (RHSA-2026:7081)
access.redhat.com/errata/RHSA-2026:7304 (RHSA-2026:7304)
access.redhat.com/errata/RHSA-2026:7335 (RHSA-2026:7335)
access.redhat.com/errata/RHSA-2026:8746 (RHSA-2026:8746)
access.redhat.com/errata/RHSA-2026:8747 (RHSA-2026:8747)
access.redhat.com/errata/RHSA-2026:8748 (RHSA-2026:8748)
access.redhat.com/security/cve/CVE-2023-52356
bugzilla.redhat.com/show_bug.cgi?id=2251344 (RHBZ#2251344)
gitlab.com/libtiff/libtiff/-/issues/622
gitlab.com/libtiff/libtiff/-/merge_requests/546