Important: libtiff

2024-02-0119:33:00

alas.aws.amazon.com

libtiff

out-of-memory flaw

remote attacker

denial of service

crafted tiff file input

cve-2023-6277

update system

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.8%

JSON

Issue Overview:

An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. (CVE-2023-6277)

Affected Packages:

libtiff

Issue Correction:
Run yum update libtiff to update your system.

New Packages:

i686:  
    libtiff-static-4.0.3-35.50.amzn1.i686  
    libtiff-debuginfo-4.0.3-35.50.amzn1.i686  
    libtiff-devel-4.0.3-35.50.amzn1.i686  
    libtiff-4.0.3-35.50.amzn1.i686  
  
src:  
    libtiff-4.0.3-35.50.amzn1.src  
  
x86_64:  
    libtiff-devel-4.0.3-35.50.amzn1.x86_64  
    libtiff-4.0.3-35.50.amzn1.x86_64  
    libtiff-static-4.0.3-35.50.amzn1.x86_64  
    libtiff-debuginfo-4.0.3-35.50.amzn1.x86_64

Additional References

Red Hat: CVE-2023-6277

Mitre: CVE-2023-6277

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686libtiff-static< 4.0.3-35.50.amzn1libtiff-static-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux1i686libtiff-debuginfo< 4.0.3-35.50.amzn1libtiff-debuginfo-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux1i686libtiff-devel< 4.0.3-35.50.amzn1libtiff-devel-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux1i686libtiff< 4.0.3-35.50.amzn1libtiff-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux1x86_64libtiff-devel< 4.0.3-35.50.amzn1libtiff-devel-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff< 4.0.3-35.50.amzn1libtiff-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff-static< 4.0.3-35.50.amzn1libtiff-static-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux1x86_64libtiff-debuginfo< 4.0.3-35.50.amzn1libtiff-debuginfo-4.0.3-35.50.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	libtiff-static	< 4.0.3-35.50.amzn1	libtiff-static-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff-debuginfo	< 4.0.3-35.50.amzn1	libtiff-debuginfo-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff-devel	< 4.0.3-35.50.amzn1	libtiff-devel-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux	1	i686	libtiff	< 4.0.3-35.50.amzn1	libtiff-4.0.3-35.50.amzn1.i686.rpm
Amazon Linux	1	x86_64	libtiff-devel	< 4.0.3-35.50.amzn1	libtiff-devel-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff	< 4.0.3-35.50.amzn1	libtiff-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff-static	< 4.0.3-35.50.amzn1	libtiff-static-4.0.3-35.50.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	libtiff-debuginfo	< 4.0.3-35.50.amzn1	libtiff-debuginfo-4.0.3-35.50.amzn1.x86_64.rpm