Linux · Security advisory · November 8, 2022

RHSA-2022:7585: Security update for 3 packages

RHSA-2022:7585, released November 8, 2022, fixes 9 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0154

75th percentile

Priority of the 9 CVEs

Patch now 0
                                Urgent 0
                                High 1
                                Routine 8

Fixed package versions

Product	Release	Fixed in
libtiff	RHEL 8	0:4.0.9-23.el8
libtiff-devel	RHEL 8	0:4.0.9-23.el8
libtiff-tools	RHEL 8	0:4.0.9-23.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2022-0891	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	7.1	0.0154	None reported
Routine	CVE-2022-0865	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0148	None reported
Routine	CVE-2022-22844	libtiff5: LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and...	6.6	0.0143	None reported
Routine	CVE-2022-0909	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0133	None reported
Routine	CVE-2022-0924	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0133	None reported
Routine	CVE-2022-0561	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0125	None reported
Routine	CVE-2022-0562	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0125	None reported
Routine	CVE-2022-0908	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0125	None reported
Routine	CVE-2022-1355	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	6.6	0.0056	None reported

Also fixes CVE-2022-0891

ALAS2023-2023-050
libtiff, libtiff-debuginfo, libtiff-debugsource and 4 more on amzn 2023
libtiff-opengl 4.0.9-5ubuntu0.5
libtiff-opengl on Ubuntu 18.04.6 LTS (bionic)
libtiff-opengl 4.1.0+git191117-2ubuntu0.20.04.3
libtiff-opengl on Ubuntu 20.04 LTS (focal)
libtiff-tools 4.0.9-5ubuntu0.5
libtiff-tools on Ubuntu 18.04.6 LTS (bionic)
libtiff-tools 4.1.0+git191117-2ubuntu0.20.04.3
libtiff-tools on Ubuntu 20.04 LTS (focal)
libtiff5 4.0.9-5ubuntu0.5
libtiff5 on Ubuntu 18.04.6 LTS (bionic)
libtiff5 4.1.0+git191117-2ubuntu0.20.04.3
libtiff5 on Ubuntu 20.04 LTS (focal)
libtiffxx5 4.0.9-5ubuntu0.5
libtiffxx5 on Ubuntu 18.04.6 LTS (bionic)

Vendor advisory

https://access.redhat.com/errata/RHSA-2022:7585

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo