ALSA-2024:2289

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)
• libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)
• libtiff: integer overflow in tiffcp.c (CVE-2023-40745)
• libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)
• libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.