CVE-2023-1916

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.(CVE-2023-1916)

A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.(CVE-2023-3164)

Root has patched CVE-2023-1916 in the tiff package for Root:Debian:12. Multiple fixed versions available.

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

• CVE-2022-34526: fix stack buffer overflow in _TIFFVGetField via invalid codec-specific tag
• CVE-2023-2908: fix null pointer dereference in countInkNamesString in tif_dir.c
• CVE-2023-6277: prevent out-of-memory attacks by comparing allocation size with file size
• CVE-2023-1916: fix out-of-bounds read in extractImageSection in tiffcrop.c
• CVE-2023-3164: fix heap-buffer-overflow in extractImageSection in tiffcrop.c

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

This update for tiff fixes the following issues:

• CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478).
• CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231).
• CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398).
• CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

This update for tiff fixes the following issues:

• CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478).
• CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231).
• CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398).
• CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

It was discovered that LibTIFF could be made to read out of bounds when processing certain malformed image files with the tiffcrop utility. If a user were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause tiffcrop to crash, resulting in a denial of service.