Oracle Linux: CVE-2023-26966: ELSA-2023-6575: libtiff security update (MODERATE) (Multiple Advisories)

Oracle Linux: CVE-2023-26966: ELSA-2023-6575:libtiff security update (MODERATE) (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:L/Au:N/C:N/I:N/A:C)

Published

02/15/2023

Created

11/18/2023

Added

11/16/2023

Modified

11/22/2024

Description

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to an out-of-bounds read in the uv_encode function in libtiff/tif_luv.c, resulting in a denial of service.

Solution(s)

• oracle-linux-upgrade-libtiff
• oracle-linux-upgrade-libtiff-devel
• oracle-linux-upgrade-libtiff-tools

References

• https://attackerkb.com/topics/cve-2023-26966
• CVE - 2023-26966
• ELSA-2023-6575