USN-6512-1: LibTIFF vulnerabilities

Severity

Medium

Vendor

Canonical Ubuntu

Description

It was discovered that LibTIFF could be made to run into an infinite loop. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-40090) It was discovered that LibTIFF could be made leak memory. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2023-3576) Update Instructions: Run `sudo pro fix USN-6512-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libtiff-opengl – 4.0.6-1ubuntu0.8+esm14 libtiffxx5 – 4.0.6-1ubuntu0.8+esm14 libtiff5-dev – 4.0.6-1ubuntu0.8+esm14 libtiff5 – 4.0.6-1ubuntu0.8+esm14 libtiff-tools – 4.0.6-1ubuntu0.8+esm14 libtiff-doc – 4.0.6-1ubuntu0.8+esm14 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

CVEs contained in this USN include: CVE-2022-40090, CVE-2023-3576.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs4
  • All versions prior to 1.53.0
• CF Deployment
  • All versions prior to 33.11.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs4
  • Upgrade all versions to 1.53.0 or greater
• CF Deployment
  • Upgrade all versions to 33.11.0 or greater

History

2024-03-18: Initial vulnerability report published.