Out-of-bounds write in LibTIFF - CVE-2023-30086
Published: August 16, 2023
Vulnerability identifier: #VU79569
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-30086
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the tiffcp() function in tiffcp.c. A remote attacker can pass specially crafted data to the application to trigger an out-of-bounds write and perform a denial of service (DoS) attack.
Affected software
LibTIFF
Amazon Linux AMI
Oracle Solaris
Data Lakehouse
IBM Watson Discovery for IBM Cloud Pak for Data
libtiff
Datacap
Amazon Linux AMI
Oracle Solaris
Data Lakehouse
IBM Watson Discovery for IBM Cloud Pak for Data
libtiff
Datacap
How to mitigate CVE-2023-30086
Install updates from vendor's website.
LibTIFF - update to 4.5.0
Data Lakehouse - update to 1.1.0.0
libtiff - update to 4.4.0-4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.3
Datacap - update to 9.1.9.0.4
Data Lakehouse - update to 1.1.0.0
libtiff - update to 4.4.0-4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.3
Datacap - update to 9.1.9.0.4
External References
Related Security Bulletins
- Denial of service in Libtiff
- Multiple vulnerabilities in Oracle Solaris third-party software
- Multiple vulnerabilities in IBM Datacap
- Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
- Multiple vulnerabilities in Dell Data Lakehouse System Software
- Amazon Linux AMI update for libtiff