Bug 2218744 (CVE-2023-25433)

Summary:	CVE-2023-25433 libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, caswilli, fjansen, hkataria, jburrell, jkoehler, jsherril, kaycoth, kshier, micjohns, nforro, rh-spice-bugs, sthirugn
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to a heap-based buffer overflow in the processCropSelections function in tools/tiffcrop.c, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2218745, 2218746, 2218747, 2219253, 2219254, 2219256, 2221289, 2221667
Bug Blocks:	2218748

Description Avinash Hanwate 2023-06-30 05:58:36 UTC

libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.

https://gitlab.com/libtiff/libtiff/-/issues/520
https://gitlab.com/libtiff/libtiff/-/merge_requests/467

Comment 2 TEJ RATHI 2023-07-03 06:16:39 UTC

Created iv tracking bugs for this issue:

Affects: fedora-all [bug 2219253]


Created libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2219254]


Created mingw-libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2219256]

Comment 9 errata-xmlrpc 2024-08-07 11:10:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5079 https://access.redhat.com/errata/RHSA-2024:5079