发布于3月6日3月6日 Members Amazon Linux 2023: CVE-2022-4645: Medium priority package update for libtiff Severity 5 CVSS (AV:L/AC:L/Au:S/C:P/I:N/A:C) Published 03/01/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. A flaw was found in tiffcp, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the tiffcp function in tools/tiffcp.c, resulting in a denial of service and limited information disclosure. Solution(s) amazon-linux-2023-upgrade-libtiff amazon-linux-2023-upgrade-libtiff-debuginfo amazon-linux-2023-upgrade-libtiff-debugsource amazon-linux-2023-upgrade-libtiff-devel amazon-linux-2023-upgrade-libtiff-static amazon-linux-2023-upgrade-libtiff-tools amazon-linux-2023-upgrade-libtiff-tools-debuginfo References https://attackerkb.com/topics/cve-2022-4645 CVE - 2022-4645 https://alas.aws.amazon.com/AL2023/ALAS-2023-230.html
