Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

SUSE: 2025:0753-1 Moderate TIFF Heap Overflow, DoS Risk Mitigated

suse
Calendar Grey February 28, 2025
Dist Suse Esm H88
SUSE's security notice details updates for libjpeg, fixing buffer overflow vulnerabilities and reducing potential Denial-of-Service risks, enhancing system security
* bsc#1212607 * bsc#1219213 * bsc#1236834 Cross-References:

Summary

## This update for tiff fixes the following issues: * CVE-2023-25435: Heap-buffer-overflow in extractContigSamplesShifted8bits() in tiffcrop.c (bsc#1212607). * CVE-2023-52356: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (bsc#1219213). Other bugfixes: * Fixed tiff build issue on s390x as test 12 test_directory fails (bsc#1236834). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-753=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-753=1 openSUSE-SLE-15.6-2025-753=1 * Basesystem Module 15-SP6

Topics%20covered

Topics Covered

security advisory moderate denial of service software update moderate severity heap overflow DoS threat SUSE SUSE Linux heap buffer overflow tiff tiff update

References

* bsc#1212607

* bsc#1219213

* bsc#1236834

Cross-

* CVE-2023-25435

* CVE-2023-52356

CVSS scores:

* CVE-2023-25435 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

* CVE-2023-25435 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2023-25435 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2023-52356 ( SUSE ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

* CVE-2023-52356 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2023-52356 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* Basesystem Module 15-SP6

* openSUSE Leap 15.6

* SUSE Linux Enterprise Desktop 15 SP6

* SUSE Linux Enterprise Real Time 15 SP6

* SUSE Linux Enterprise Server 15 SP6

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

Announcement ID: SUSE-SU-2025:0753-1
Release Date: 2025-02-28T16:30:46Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service software update moderate severity heap overflow DoS threat SUSE SUSE Linux heap buffer overflow tiff tiff update

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here