MGASA-2023-0255 - Updated libtiff packages fix security vulnerability

Publication date: 11 Sep 2023
URL: https://advisories.mageia.org/MGASA-2023-0255.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-2908,
     CVE-2023-3316,
     CVE-2023-3618,
     CVE-2023-25433,
     CVE-2023-26965,
     CVE-2023-26966

A null pointer dereference issue was found in Libtiff's tif_dir.c file.
This issue may allow an attacker to pass a crafted TIFF image file to the
tiffcp utility which triggers a runtime error that causes undefined
behavior. This will result in an application crash, eventually leading to
a denial of service. (CVE-2023-2908)

A NULL pointer dereference in TIFFClose() is caused by a failure to open
an output file (non-existent path or a path that requires permissions like
/dev/null) while specifying zones. (CVE-2023-3316)

A vulnerability was found in SourceCodester Resort Management System 1.0.
It has been declared as problematic. Affected by this vulnerability is an
unknown functionality. The manipulation of the argument page leads to
cross site scripting. The attack can be launched remotely. The exploit has
been disclosed to the public and may be used. (CVE-2023-3618)

libtiff 4.5.0 is vulnerable to Buffer Overflow in
/libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after
rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.
(CVE-2023-25433)

loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based
use after free via a crafted TIFF image. (CVE-2023-26965)

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff
reads a corrupted little-endian TIFF file and specifies the output to be
big-endian. (CVE-2023-26966)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32117
- https://ubuntu.com/security/notices/USN-6229-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2908
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3316
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3618
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25433
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26965
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26966

SRPMS:
- 9/core/libtiff-4.5.1-1.mga9