Oracle Linux: CVE-2023-25433: ELSA-2024-5079: libtiff security update (MODERATE) (Multiple Advisories)

Oracle Linux: CVE-2023-25433: ELSA-2024-5079:libtiff security update (MODERATE) (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:L/Au:N/C:N/I:N/A:C)

Published

01/27/2023

Created

08/20/2024

Added

08/16/2024

Modified

11/30/2024

Description

libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to a heap-based buffer overflow in the processCropSelections function in tools/tiffcrop.c, resulting in a denial of service.

Solution(s)

• oracle-linux-upgrade-libtiff
• oracle-linux-upgrade-libtiff-devel
• oracle-linux-upgrade-libtiff-tools

References

• https://attackerkb.com/topics/cve-2023-25433
• CVE - 2023-25433
• ELSA-2024-5079