Linux · Security advisory · November 7, 2023

RHSA-2023:6575: Security update for 3 packages

RHSA-2023:6575, released November 7, 2023, fixes 6 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.1064

95th percentile

Patch now 0
                                Urgent 0
                                High 1
                                Routine 5

Fixed package versions

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2017-17095	libtiff: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security...	7.5	0.1064	None reported
Routine	CVE-2023-3316	tiff: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path...	6.5	0.0112	None reported
Routine	CVE-2023-2731	tiff: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file	5.5	0.0043	None reported
Routine	CVE-2023-26966	tiff: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file...	5.5	0.0042	None reported
Routine	CVE-2023-26965	tiff: loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.	5.5	0.0037	None reported
Routine	CVE-2023-3576	tiff: A memory leak flaw was found in Libtiff's tiffcrop utility	5.5	0.0035	None reported