Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Ubuntu 22.04 LTS: USN-6512-1 Critical LibTIFF Denial Of Service

ubuntu
Calendar Grey November 23, 2023
Dist Ubuntu Esm H88
Multiple security flaws in LibTIFF have been fixed in Ubuntu LTS versions 22.04, 20.04, down to 14.04. Follow the provided guidelines for updates.
Several security issues were fixed in LibTIFF.

Summary

Several security issues were fixed in LibTIFF.

Software Description:

- tiff: Tag Image File Format (TIFF) library

Details:

It was discovered that LibTIFF could be made to run into an infinite loop.

If a user or an automated system were tricked into opening a specially

crafted image file, an attacker could possibly use this issue to cause a

denial of service. (CVE-2022-40090)

It was discovered that LibTIFF could be made leak memory. If a user or an

automated system were tricked into opening a specially crafted image file,

an attacker could possibly use this issue to cause a denial of service.

(CVE-2023-3576)

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu libtiff

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
   libtiff-tools                   4.3.0-6ubuntu0.7
   libtiff5                        4.3.0-6ubuntu0.7

Ubuntu 20.04 LTS:
   libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.11
   libtiff5 4.1.0+git191117-2ubuntu0.20.04.11

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libtiff-tools                   4.0.9-5ubuntu0.10+esm4
   libtiff5                        4.0.9-5ubuntu0.10+esm4

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libtiff-tools                   4.0.6-1ubuntu0.8+esm14
   libtiff5                        4.0.6-1ubuntu0.8+esm14

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   libtiff-tools                   4.0.3-7ubuntu0.11+esm11
   libtiff5                        4.0.3-7ubuntu0.11+esm11

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6512-1

  CVE-2022-40090, CVE-2023-3576

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6512-1

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu libtiff

Package Information

  https://launchpad.net/ubuntu/+source/tiff/4.3.0-6ubuntu0.7
https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.11

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here