Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Mageia 9: 2023-0255 Moderate: Libtiff Runtime Error and DoS

mageia
Calendar Grey September 11, 2023
Dist Mageia Esm H88
Mageia 2023-0256 resolves various vulnerabilities in libjpeg, such as an arbitrary code execution risk linked to a buffer overflow.
A null pointer dereference issue was found in Libtiff's tif_dir.c file

Summary

A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service. (CVE-2023-2908)
A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. (CVE-2023-3316)
A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. (CVE-2023-3618)
libtiff 4.5.0 is vulnerable to Buffer Overflow in /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size af...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=32117

- https://ubuntu.com/security/notices/USN-6229-1

- https://www.cve.org/CVERecord?id=CVE-2023-2908

- https://www.cve.org/CVERecord?id=CVE-2023-3316

- https://www.cve.org/CVERecord?id=CVE-2023-3618

- https://www.cve.org/CVERecord?id=CVE-2023-25433

- https://www.cve.org/CVERecord?id=CVE-2023-26965

- https://www.cve.org/CVERecord?id=CVE-2023-26966

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow software update Mageia runtime error Libtiff

Resolution

SRPMS

- 9/core/libtiff-4.5.1-1.mga9

Publication date: 11 Sep 2023
URL: https://advisories.mageia.org/MGASA-2023-0255.html
Type: security
CVE: CVE-2023-2908, CVE-2023-3316, CVE-2023-3618, CVE-2023-25433, CVE-2023-26965, CVE-2023-26966

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow software update Mageia runtime error Libtiff

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here