Bug 2218749 (CVE-2023-26966)

Summary:	CVE-2023-26966 libtiff: Buffer Overflow in uv_encode()
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aprice, bdettelb, caswilli, crizzo, doconnor, fjansen, hkataria, jburrell, jkoehler, jsamir, jsherril, kaycoth, kholdawa, kshier, lcouzens, lphiri, micjohns, mskarbek, nforro, oezr, rh-spice-bugs, sthirugn, teagle, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to an out-of-bounds read in the uv_encode function in libtiff/tif_luv.c, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2218754, 2218755, 2218756, 2219255, 2219257, 2219258, 2221290, 2221668
Bug Blocks:	2218748

Description Avinash Hanwate 2023-06-30 06:07:48 UTC

libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.

https://gitlab.com/libtiff/libtiff/-/issues/530
https://gitlab.com/libtiff/libtiff/-/merge_requests/473

Comment 2 TEJ RATHI 2023-07-03 06:16:50 UTC

Created iv tracking bugs for this issue:

Affects: fedora-all [bug 2219255]


Created libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2219257]


Created mingw-libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2219258]

Comment 7 errata-xmlrpc 2023-11-07 08:19:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6575 https://access.redhat.com/errata/RHSA-2023:6575