Linux · Security advisory · November 11, 2023
ELSA-2023-6575: Security update for 3 packages
ELSA-2023-6575, released November 11, 2023, fixes 5 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Routine.
Routine
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0112
66th percentile
Priority of the 5 CVEs
Patch now 0
Urgent 0
High 0
Routine 5
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| libtiff | ol 9 | 0:4.4.0-10.el9 |
| libtiff-devel | ol 9 | 0:4.4.0-10.el9 |
| libtiff-tools | ol 9 | 0:4.4.0-10.el9 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Routine | CVE-2023-3316 | tiff: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path... | 6.5 | 0.0112 | None reported | |
| Routine | CVE-2023-2731 | tiff: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file | 5.5 | 0.0043 | None reported | |
| Routine | CVE-2023-26966 | tiff: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file... | 5.5 | 0.0042 | None reported | |
| Routine | CVE-2023-26965 | tiff: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. | 5.5 | 0.0037 | None reported | |
| Routine | CVE-2023-3576 | tiff: A memory leak flaw was found in Libtiff's tiffcrop utility | 5.5 | 0.0035 | None reported |
Showing 1 to 5 of 5
1