Out-of-bounds read in LibTIFF - CVE-2023-0796

Vulnerability identifier: #VU72592

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-0796

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the tiffcrop() function in tools/tiffcrop.c. A remote attacker can pass a specially crafted TIFF file to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

LibTIFF
Debian Linux
Amazon Linux AMI
Oracle Linux
Gentoo Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Oracle Solaris
Ubuntu
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Data Lakehouse
Isolation Segment
VMware Tanzu Application Service for VMs
libtiff-tools (Ubuntu package)
libtiff5 (Ubuntu package)
libtiff
tiff-debugsource
libtiff-devel
tiff-debuginfo
tiff
libtiff5
libtiff5-debuginfo
libtiff5-32bit
libtiff5-debuginfo-32bit
libtiff-devel-32bit
libtiff5-32bit-debuginfo
tiff (Debian package)
libtiff-help
libtiff-debuginfo
libtiff-debugsource
libtiff (Red Hat package)
media-libs/tiff
cflinuxfs3
Dell PowerProtect Cyber Recovery
VMware Tanzu Operations Manager
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
RecoverPoint for VMs

Install updates from vendor's repository.

Data Lakehouse - update to 1.1.0.0
libtiff-tools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.0.9-5ubuntu0.10, 4.1.0+git191117-2ubuntu0.20.04.8, 4.3.0-6ubuntu0.4, 4.4.0-4ubuntu3.3
libtiff5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.0.9-5ubuntu0.10, 4.1.0+git191117-2ubuntu0.20.04.8, 4.3.0-6ubuntu0.4, 4.4.0-4ubuntu3.3
cflinuxfs3 - update to 0.356.0
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
Isolation Segment - addressed in versions 2.11.30, 2.12.20, 2.13.15, 3.0.8, 4.0.0
VMware Tanzu Application Service for VMs - addressed in versions 2.11.36, 2.12.25, 2.13.18, 3.0.8, 4.0.0
libtiff - addressed in versions 4.0.3-35.45, 4.4.0-4
tiff-debugsource - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
libtiff-devel - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
tiff-debuginfo - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
tiff - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
libtiff5 - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
libtiff5-debuginfo - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
libtiff5-32bit - addressed in versions 4.0.9-44.68.1, 4.0.9-150000.45.28.1
libtiff5-debuginfo-32bit - update to 4.0.9-44.68.1
libtiff-devel-32bit - update to 4.0.9-150000.45.28.1
libtiff5-32bit-debuginfo - update to 4.0.9-150000.45.28.1
tiff (Debian package) - update to 4.2.0-1+deb11u4
libtiff-help - update to 4.3.0-9
libtiff-debuginfo - update to 4.3.0-9
libtiff - update to 4.3.0-9
libtiff-debugsource - update to 4.3.0-9
libtiff-devel - update to 4.3.0-9
libtiff (Red Hat package) - update to 4.4.0-8.el9_2
libtiff - update to 4.4.0-8.0.1
libtiff-devel - update to 4.4.0-8.0.1
media-libs/tiff - update to 4.5.0-r2
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0796.json
• https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68
• https://gitlab.com/libtiff/libtiff/-/issues/499

• Multiple DoS vulnerabilities in LibTIFF
• Debian update for tiff
• Ubuntu update for tiff
• Cloud Foundry Foundation cflinuxfs3 update for LibTIFF
• Multiple vulnerabilities in Oracle Solaris third-party software
• VMware Tanzu products update for LibTIFF
• Gentoo update for LibTIFF
• SUSE update for tiff
• SUSE update for tiff
• Red Hat Enterprise Linux 9 update for libtiff
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Amazon Linux AMI update for libtiff
• openEuler update for libtiff
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for libtiff
• Anolis OS update for libtiff
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)