发布于3月6日3月6日 Members Oracle Linux: CVE-2022-4645: ELSA-2023-2340:libtiff security update (MODERATE) (Multiple Advisories) Severity 5 CVSS (AV:L/AC:L/Au:S/C:P/I:N/A:C) Published 03/01/2023 Created 05/18/2023 Added 05/17/2023 Modified 11/29/2024 Description LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. A flaw was found in tiffcp, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the tiffcp function in tools/tiffcp.c, resulting in a denial of service and limited information disclosure. Solution(s) oracle-linux-upgrade-libtiff oracle-linux-upgrade-libtiff-devel oracle-linux-upgrade-libtiff-tools References https://attackerkb.com/topics/cve-2022-4645 CVE - 2022-4645 ELSA-2023-2340 ELSA-2024-3059
