USN-6644-1: LibTIFF vulnerabilities
19 February 2024
Several security issues were fixed in LibTIFF.
Releases
Packages
- tiff - Tag Image File Format (TIFF) library
Details
It was discovered that LibTIFF incorrectly handled certain files. If
a user were tricked into opening a specially crafted file, an attacker
could possibly use this issue to cause the application to crash, resulting
in a denial of service. (CVE-2023-52356)
It was discovered that LibTIFF incorrectly handled certain image files
with the tiffcp utility. If a user were tricked into opening a specially
crafted image file, an attacker could possibly use this issue to cause
tiffcp to crash, resulting in a denial of service. (CVE-2023-6228)
It was discovered that LibTIFF incorrectly handled certain files. If
a user were tricked into opening a specially crafted file, an attacker
could possibly use this issue to cause the application to consume
resources, resulting in a denial of service. (CVE-2023-6277)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.10
Ubuntu 20.04
Ubuntu 18.04
-
libtiff-tools
-
4.0.9-5ubuntu0.10+esm5
Available with Ubuntu Pro
-
libtiff5
-
4.0.9-5ubuntu0.10+esm5
Available with Ubuntu Pro
Ubuntu 16.04
-
libtiff-tools
-
4.0.6-1ubuntu0.8+esm15
Available with Ubuntu Pro
-
libtiff5
-
4.0.6-1ubuntu0.8+esm15
Available with Ubuntu Pro
Ubuntu 14.04
-
libtiff-tools
-
4.0.3-7ubuntu0.11+esm12
Available with Ubuntu Pro
-
libtiff5
-
4.0.3-7ubuntu0.11+esm12
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-6644-2: libtiff-dev, libtiff5-dev, libtiff5, libtiffxx5, libtiff-doc, libtiff-opengl, tiff, libtiff-tools