Medium: libtiff

2023-09-2722:15:00

alas.aws.amazon.com

libtiff

heap buffer overflow

cve-2023-30774

update

red hat

mitre

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

23.3%

JSON

Issue Overview:

A vulnerability was found in libtiff library. This security flaw causes a heap buffer overflow issue via TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values. (CVE-2023-30774)

Affected Packages:

libtiff

Issue Correction:
Run yum update libtiff to update your system.

New Packages:

i686:  
    libtiff-static-4.0.3-35.47.amzn1.i686  
    libtiff-debuginfo-4.0.3-35.47.amzn1.i686  
    libtiff-devel-4.0.3-35.47.amzn1.i686  
    libtiff-4.0.3-35.47.amzn1.i686  
  
src:  
    libtiff-4.0.3-35.47.amzn1.src  
  
x86_64:  
    libtiff-devel-4.0.3-35.47.amzn1.x86_64  
    libtiff-debuginfo-4.0.3-35.47.amzn1.x86_64  
    libtiff-static-4.0.3-35.47.amzn1.x86_64  
    libtiff-4.0.3-35.47.amzn1.x86_64

Additional References

Red Hat: CVE-2023-30774

Mitre: CVE-2023-30774

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686libtiff-static< 4.0.3-35.47.amzn1libtiff-static-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux1i686libtiff-debuginfo< 4.0.3-35.47.amzn1libtiff-debuginfo-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux1i686libtiff-devel< 4.0.3-35.47.amzn1libtiff-devel-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux1i686libtiff< 4.0.3-35.47.amzn1libtiff-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux1x86_64libtiff-devel< 4.0.3-35.47.amzn1libtiff-devel-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff-debuginfo< 4.0.3-35.47.amzn1libtiff-debuginfo-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff-static< 4.0.3-35.47.amzn1libtiff-static-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff< 4.0.3-35.47.amzn1libtiff-4.0.3-35.47.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	libtiff-static	< 4.0.3-35.47.amzn1	libtiff-static-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff-debuginfo	< 4.0.3-35.47.amzn1	libtiff-debuginfo-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff-devel	< 4.0.3-35.47.amzn1	libtiff-devel-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff	< 4.0.3-35.47.amzn1	libtiff-4.0.3-35.47.amzn1.i686.rpm
Amazon Linux	1	x86_64	libtiff-devel	< 4.0.3-35.47.amzn1	libtiff-devel-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff-debuginfo	< 4.0.3-35.47.amzn1	libtiff-debuginfo-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff-static	< 4.0.3-35.47.amzn1	libtiff-static-4.0.3-35.47.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff	< 4.0.3-35.47.amzn1	libtiff-4.0.3-35.47.amzn1.x86_64.rpm