Alerts This Week
Warning Icon 1 1,295
Alerts This Week
Warning Icon 1 1,295

Debian 11: DLA-4026-1 Critical tiff Buffer Overflow & Dereference Issues

debian lts
Calendar Grey January 20, 2025
Dist Debian Esm H88
Several vulnerabilities addressed in the tiff utility; users of Debian LTS are advised to upgrade for improved security measures.
Multiple vulnerabilities were fixed in tiff, a library and tools providing support for the Tag Image File Format (TIFF)
Topics%20covered

Topics Covered

security advisory buffer overflow Debian image processing tiff NULL pointer dereference

Summary


CVE-2023-2908

NULL pointer dereference in tif_dir.c

CVE-2023-3316

NULL pointer dereference in TIFFClose()

CVE-2023-3618

Buffer overflow in tiffcrop

CVE-2023-25433

Buffer overflow in tiffcrop

CVE-2023-26965

Use after free in tiffcrop

CVE-2023-26966

Buffer overflow in uv_encode()

CVE-2023-52356

segfault in TIFFReadRGBAStrip()/TIFFReadRGBATile()

CVE-2024-7006

NULL pointer dereference in TIFFReadDirectory()/TIFFReadCustomDirectory()


For Debian 11 bullseye, these problems have been fixed in version
4.2.0-1+deb11u6.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/tiff

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: tiff
Version: 4.2.0-1+deb11u6
CVE ID: CVE-2023-2908 CVE-2023-3316 CVE-2023-3618 CVE-2023-25433
Debian Bug:

Topics%20covered

Topics Covered

security advisory buffer overflow Debian image processing tiff NULL pointer dereference

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here