CVE-2022-3598
Description
Moderate: libtiff security update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux 9libtiff-0:4.4.0-7.el9RHSA-2023:23402023-05-09T00:00:00Z Package state ProductPackageState Red Hat Enterprise Linux 6libtiffOut of support scope Red Hat…
Description
libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 9 | libtiff-0:4.4.0-7.el9 | RHSA-2023:2340 | 2023-05-09T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | libtiff | Out of support scope |
| Red Hat Enterprise Linux 7 | compat-libtiff3 | Out of support scope |
| Red Hat Enterprise Linux 7 | libtiff | Out of support scope |
| Red Hat Enterprise Linux 8 | compat-libtiff3 | Will not fix |
| Red Hat Enterprise Linux 8 | libtiff | Will not fix |
Apply commands
yum update -y libtiff
# or:
dnf upgrade -y libtiffOS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
AlmaLinux Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | libtiff-4.4.0-7.el9.aarch64.rpm |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 4.4.0-5 |
| sid | Fixed | 4.4.0-5 |
| forky | Fixed | 4.4.0-5 |
| bullseye | Fixed | 4.2.0-1+deb11u3 |
| bookworm | Fixed | 4.4.0-5 |
Red Hat Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
References
- https://access.redhat.com/errata/RHSA-2023:2340
- https://www.suse.com/security/cve/CVE-2022-3598.html
- https://security-tracker.debian.org/tracker/CVE-2022-3598
- https://bugzilla.redhat.com/2142734
- https://bugzilla.redhat.com/2142736
- https://bugzilla.redhat.com/2142738
- https://bugzilla.redhat.com/2142740
- https://bugzilla.redhat.com/2142741
- https://bugzilla.redhat.com/2142742
- https://bugzilla.redhat.com/2148918
- https://bugzilla.redhat.com/2176220
- https://bugzilla.redhat.com/2187139
- https://bugzilla.redhat.com/2187141
- https://errata.almalinux.org/9/ALSA-2023-2340.html
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.