CVE-2023-3576

A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.

A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.

This libtiff provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A vulnerability was found in libtiff where a memory leak exists in tools/tiffcrop.c.

References: https://gitlab.com/libtiff/libtiff/-/merge_requests/475(CVE-2023-3576)

A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731)
• libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316)
• libtiff: memory leak in tiffcrop.c (CVE-2023-3576)
• libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c (CVE-2023-26965)
• libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-3316: avoid NULL pointer dereference in TIFFClose() when output file fails to open due to invalid path or permissions
• CVE-2023-3618: handle errors from writeSelections() to prevent buffer overflow in Fax3Encode() and potential DoS
• CVE-2023-3576: resolve memory leak in tiffcrop.c to prevent potential DoS via crafted TIFF file

This update for tiff fixes the following issues:

• CVE-2023-38289: Fixed a NULL pointer dereference in raw2tiff (bsc#1213589).
• CVE-2023-38288: Fixed an integer overflow in raw2tiff (bsc#1213590).
• CVE-2023-3576: Fixed a memory leak in tiffcrop (bsc#1213273).
• CVE-2020-18768: Fixed an out of bounds read in tiffcp (bsc#1214574).
• CVE-2023-26966: Fixed an out of bounds read when transforming a little-endian file to a big-endian output (bsc#1212881)
• CVE-2023-3618: Fixed a NULL pointer dereference while encoding FAX3 files (bsc#1213274).
• CVE-2023-2908: Fixed an undefined behavior issue when doing pointer arithmetic on a NULL pointer (bsc#1212888).
• CVE-2023-3316: Fixed a NULL pointer dereference while opening a file in an inaccessible path (bsc#1212535).
• CVE-2023-25433: Fixed a buffer overflow in tiffcrop (bsc#1212883).

This update for tiff fixes the following issues:

• CVE-2023-38289: Fixed a NULL pointer dereference in raw2tiff (bsc#1213589).
• CVE-2023-38288: Fixed an integer overflow in raw2tiff (bsc#1213590).
• CVE-2023-3576: Fixed a memory leak in tiffcrop (bsc#1213273).
• CVE-2020-18768: Fixed an out of bounds read in tiffcp (bsc#1214574).
• CVE-2023-26966: Fixed an out of bounds read when transforming a little-endian file to a big-endian output (bsc#1212881)
• CVE-2023-3618: Fixed a NULL pointer dereference while encoding FAX3 files (bsc#1213274).
• CVE-2023-2908: Fixed an undefined behavior issue when doing pointer arithmetic on a NULL pointer (bsc#1212888).
• CVE-2023-3316: Fixed a NULL pointer dereference while opening a file in an inaccessible path (bsc#1212535).
• CVE-2023-25433: Fixed a buffer overflow in tiffcrop (bsc#1212883).

It was discovered that LibTIFF could be made to run into an infinite loop. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-40090)

It was discovered that LibTIFF could be made leak memory. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2023-3576)