NULL pointer dereference in LibTIFF - CVE-2023-2908

Vulnerability identifier: #VU78786

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-2908

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in tif_dir.c. A remote attacker can pass a specially crafted TIFF file to the application and perform a denial of service (DoS) attack.

LibTIFF
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Ubuntu
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
openEuler
SQL Sentry
libtiff-tools (Ubuntu package)
libtiff5 (Ubuntu package)
tiff-debuginfo
libtiff5-32bit
tiff-debugsource
tiff
libtiff5-debuginfo
libtiff5
libtiff5-debuginfo-32bit
libtiff-devel
libtiff5-32bit-debuginfo
libtiff-devel-32bit
libtiff
libtiff-debugsource
libtiff-debuginfo
libtiff-help
libtiff6 (Ubuntu package)
VMware Tanzu Operations Manager
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Watson Discovery for IBM Cloud Pak for Data
Datacap

Install updates from vendor's website.

LibTIFF - update to 4.5.1
SQL Sentry - update to 2024.2
libtiff-tools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.1.0+git191117-2ubuntu0.20.04.9, 4.3.0-6ubuntu0.5, 4.5.0-5ubuntu1.1
libtiff5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.1.0+git191117-2ubuntu0.20.04.9, 4.3.0-6ubuntu0.5
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
Isolation Segment - addressed in versions 2.11.38, 2.13.23, 3.0.16, 4.0.8
VMware Tanzu Application Service for VMs - addressed in versions 2.11.44, 2.13.26, 3.0.16, 4.0.8
tiff-debuginfo - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
libtiff5-32bit - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
tiff-debugsource - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
tiff - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
libtiff5-debuginfo - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
libtiff5 - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
libtiff5-debuginfo-32bit - update to 4.0.9-44.71.1
libtiff-devel - addressed in versions 4.0.9-44.71.1, 4.0.9-150000.45.32.1
libtiff5-32bit-debuginfo - update to 4.0.9-150000.45.32.1
libtiff-devel-32bit - update to 4.0.9-150000.45.32.1
libtiff - update to 4.3.0-14
libtiff-debugsource - update to 4.3.0-14
libtiff-debuginfo - update to 4.3.0-14
libtiff-devel - update to 4.3.0-14
libtiff-help - update to 4.3.0-14
libtiff6 (Ubuntu package) - update to 4.5.0-5ubuntu1.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.3
Datacap - update to 9.1.9.0.4

• https://access.redhat.com/security/cve/CVE-2023-2908
• https://bugzilla.redhat.com/show_bug.cgi?id=2218830
• https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
• https://gitlab.com/libtiff/libtiff/-/merge_requests/479

• Denial of service in Libtiff
• Ubuntu update for tiff
• VMware Tanzu products update for LibTIFF
• SUSE update for tiff
• SUSE update for tiff
• Multiple vulnerabilities in IBM Datacap
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• openEuler update for libtiff
• SolarWinds SQL Sentry update for third-party components