Debian 10 Buster DLA-3758-1 Moderate: TIFF Memory Leak And Heap Overflow

debian lts

March 11, 2024

Two vulnerabilities were discovered in tiff, Tag Image File Format library

Topics Covered

security advisory denial of service debian heap overflow memory leak tiff

Summary

CVE-2023-3576

A memory leak flaw was found in Libtiff's tiffcrop utility. This
issue occurs when tiffcrop operates on a TIFF image file, allowing
an attacker to pass a crafted TIFF image file to tiffcrop utility,
which causes this memory leak issue, resulting an application
crash, eventually leading to a denial of service

CVE-2023-52356

A segment fault (SEGV) flaw was found in libtiff that could be
triggered by passing a crafted tiff file to the
TIFFReadRGBATileExt() API. This flaw allows a remote attacker to
cause a heap-buffer overflow, leading to a denial of service.

For Debian 10 buster, these problems have been fixed in version
4.1.0+git191117-2~deb10u9.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/tiff

Further information about Debian LTS security advisories, how to apply