Bugzilla – Bug 1212607
VUL-0: CVE-2023-25435: tiff: heap-buffer-overflow in extractContigSamplesShifted8bits() in tiffcrop.c
Last modified: 2024-06-07 12:22:55 UTC
CVE-2023-25435 libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. Upstream fix: https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-25435 https://bugzilla.redhat.com/show_bug.cgi?id=2216614 https://www.cve.org/CVERecord?id=CVE-2023-25435 https://gitlab.com/libtiff/libtiff/-/issues/518
Got ASAN crash on SUSE:ALP:Source:Standard:1.0/tiff.
(In reply to Thomas Leroy from comment #1) > Got ASAN crash on SUSE:ALP:Source:Standard:1.0/tiff. Is this only valid for ALP? ALP got recently updated to 4.6.0 so should be fixed.
Please see https://bugzilla.suse.com/show_bug.cgi?id=1212607#c5
(In reply to Michael Vetter from comment #6) > Please see https://bugzilla.suse.com/show_bug.cgi?id=1212607#c5 Sorry for the delay Michael. ALP is already fixed with 4.6.0, but the changes file doesn't contain a reference to this bug. I would say it's not necessary to submit a changelog update only, but could you please ensure that the next submission to ALP will add bsc#1212607 and CVE-2023-25435 in the changes file? :)
> I would say it's not necessary to submit a changelog update only, > but could you please ensure that the next submission to ALP will add > bsc#1212607 and CVE-2023-25435 in the changes file? :) I did it now before I forget. And there was still a submission open anyways :) SR#314828 to SUSE:ALP:Source:Standard:1.0
This is an autogenerated message for OBS integration: This bug (1212607) was mentioned in https://build.opensuse.org/request/show/1131379 Factory / tiff
All done, closing.