Issued:
2020-04-28
Updated:
2020-04-28

RHSA-2020:1688 - Security Advisory

Synopsis

Moderate: libtiff security update

Type/Severity

Security Advisory: Moderate

Topic

An update for libtiff is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

  • libtiff: integer overflow in _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c (CVE-2019-14973)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 1745951 - CVE-2019-14973 libtiff: integer overflow in _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
libtiff-4.0.9-17.el8.src.rpm SHA-256: 25a2554a39bd95f17a88973e2bafcc708b0ebd8d09753426dbf18e874d30824a
x86_64
libtiff-4.0.9-17.el8.i686.rpm SHA-256: 48465f309379f29ebea984ff335a0049f76d889232f92cd49b4096a7c961680c
libtiff-4.0.9-17.el8.x86_64.rpm SHA-256: ac5b5016d23a7c7073e21ac9bfc20fb54f73f7e518c19c9571f68911bf891800
libtiff-debuginfo-4.0.9-17.el8.i686.rpm SHA-256: dc56f64d72643075708eb75542caf50a017ecc2b6a00fe3c27c0029902f521db
libtiff-debuginfo-4.0.9-17.el8.x86_64.rpm SHA-256: 734504302a9ec959e6a883393ad339615e8d673eb5be80436345a0b823ecd24a
libtiff-debugsource-4.0.9-17.el8.i686.rpm SHA-256: ada3d251d7d99be67cd12408ae042c643c9eb307c26104be8447fd1e67f4b67e
libtiff-debugsource-4.0.9-17.el8.x86_64.rpm SHA-256: 73011d66990570cf4d8af4042024a98081b1cfa3545ffaf8744d4aaf525f631f
libtiff-devel-4.0.9-17.el8.i686.rpm SHA-256: 6821e943d38c7fcc211b90cd264db0ca668ac934ca0dc57481eebdf980d6f628
libtiff-devel-4.0.9-17.el8.x86_64.rpm SHA-256: 3e58f8c545245bd4b3f85a9addbff0e25f6d40f815d4b4302fafeb3f3ac90147
libtiff-tools-debuginfo-4.0.9-17.el8.i686.rpm SHA-256: d598972049816d58c89687f07c0063fd3c85fb733c39e7083455be79ee665b6b
libtiff-tools-debuginfo-4.0.9-17.el8.x86_64.rpm SHA-256: c19e94c49d176fc04406bedacafd032ee342508d3c44307bae68238473efa523

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libtiff-4.0.9-17.el8.src.rpm SHA-256: 25a2554a39bd95f17a88973e2bafcc708b0ebd8d09753426dbf18e874d30824a
s390x
libtiff-4.0.9-17.el8.s390x.rpm SHA-256: 3330f7597edc44444632b28fcf0eb844e95343b8315000ca4cde14458f2896fb
libtiff-debuginfo-4.0.9-17.el8.s390x.rpm SHA-256: ca8d7bc8b984450d4177e20b76c069b2348ed4bb1f51ded8b432c5bc3c5968bd
libtiff-debugsource-4.0.9-17.el8.s390x.rpm SHA-256: fa4cce12fb4fcc8fd2b9fd1b525ed6961688eb2da6712763acd77639ddd23a44
libtiff-devel-4.0.9-17.el8.s390x.rpm SHA-256: b02048999cd6f8c89975b723b37f139a6138a8c743232f7bfe03cb6b713c6f68
libtiff-tools-debuginfo-4.0.9-17.el8.s390x.rpm SHA-256: a86a5102924cac8c2c608dbb0added05e686aee5b5c2987f80aa06c378aca3bf

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libtiff-4.0.9-17.el8.src.rpm SHA-256: 25a2554a39bd95f17a88973e2bafcc708b0ebd8d09753426dbf18e874d30824a
ppc64le
libtiff-4.0.9-17.el8.ppc64le.rpm SHA-256: 2e62d405338371f4f752a23b0ec768efff6a1fa4f6e459e63cf790d6bb4d3ef1
libtiff-debuginfo-4.0.9-17.el8.ppc64le.rpm SHA-256: ee3e316e31fad9ddd9528070a3c9e183b1c09196a57b575c70c1524bf698fa2a
libtiff-debugsource-4.0.9-17.el8.ppc64le.rpm SHA-256: 6a2a9fe26ab2fe7875abef3ede28779cc8d4f62daa00f5320ab15c843a837c6d
libtiff-devel-4.0.9-17.el8.ppc64le.rpm SHA-256: 78b3adab1ff9968c96d182c935995fecc39fdf0778475b18a75dd509daa7ba4f
libtiff-tools-debuginfo-4.0.9-17.el8.ppc64le.rpm SHA-256: 99e08d89f1cffc9ee951ad0ba90cfe4b92151a0ff26a81e6b7c77df717a4efaf

Red Hat Enterprise Linux for ARM 64 8

SRPM
libtiff-4.0.9-17.el8.src.rpm SHA-256: 25a2554a39bd95f17a88973e2bafcc708b0ebd8d09753426dbf18e874d30824a
aarch64
libtiff-4.0.9-17.el8.aarch64.rpm SHA-256: 85920dcdf89e6ddca984a435d2f525044d3899d43c048069f0bcfea13bc729eb
libtiff-debuginfo-4.0.9-17.el8.aarch64.rpm SHA-256: 759604089d7c820b63ff27bf36a4ca86741636223b5fd32b0ca6db71d0290d9f
libtiff-debugsource-4.0.9-17.el8.aarch64.rpm SHA-256: 3afdbea9d5b0b36fe17da2ad1e79b672ba862b501e9d73ad3e7f33d46201ccbb
libtiff-devel-4.0.9-17.el8.aarch64.rpm SHA-256: 0dddcc440d82a4bcf3a9c963b4bbf8c9d472c357b21a43db54210afc19592825
libtiff-tools-debuginfo-4.0.9-17.el8.aarch64.rpm SHA-256: 0bc422df18d548889900599ba89649aeeaa6392fd66786c14581d788ff4f1f55

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
libtiff-debuginfo-4.0.9-17.el8.x86_64.rpm SHA-256: 734504302a9ec959e6a883393ad339615e8d673eb5be80436345a0b823ecd24a
libtiff-debugsource-4.0.9-17.el8.x86_64.rpm SHA-256: 73011d66990570cf4d8af4042024a98081b1cfa3545ffaf8744d4aaf525f631f
libtiff-tools-4.0.9-17.el8.x86_64.rpm SHA-256: d62b8d64fe689a6b4e63292ab4e856ea193488ec022be5f2fbd72b662f6a02f5
libtiff-tools-debuginfo-4.0.9-17.el8.x86_64.rpm SHA-256: c19e94c49d176fc04406bedacafd032ee342508d3c44307bae68238473efa523

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
libtiff-debuginfo-4.0.9-17.el8.ppc64le.rpm SHA-256: ee3e316e31fad9ddd9528070a3c9e183b1c09196a57b575c70c1524bf698fa2a
libtiff-debugsource-4.0.9-17.el8.ppc64le.rpm SHA-256: 6a2a9fe26ab2fe7875abef3ede28779cc8d4f62daa00f5320ab15c843a837c6d
libtiff-tools-4.0.9-17.el8.ppc64le.rpm SHA-256: 9b03202c4eed31740c0ffdfd4490b8deaf2fa94c61d064c5d5b0ee6c34351e64
libtiff-tools-debuginfo-4.0.9-17.el8.ppc64le.rpm SHA-256: 99e08d89f1cffc9ee951ad0ba90cfe4b92151a0ff26a81e6b7c77df717a4efaf

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
libtiff-debuginfo-4.0.9-17.el8.aarch64.rpm SHA-256: 759604089d7c820b63ff27bf36a4ca86741636223b5fd32b0ca6db71d0290d9f
libtiff-debugsource-4.0.9-17.el8.aarch64.rpm SHA-256: 3afdbea9d5b0b36fe17da2ad1e79b672ba862b501e9d73ad3e7f33d46201ccbb
libtiff-tools-4.0.9-17.el8.aarch64.rpm SHA-256: c9593c96b41305b7894a99c796316dcd8eb4848b4ac5b9006c4b80f9570b3ff2
libtiff-tools-debuginfo-4.0.9-17.el8.aarch64.rpm SHA-256: 0bc422df18d548889900599ba89649aeeaa6392fd66786c14581d788ff4f1f55

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
libtiff-debuginfo-4.0.9-17.el8.s390x.rpm SHA-256: ca8d7bc8b984450d4177e20b76c069b2348ed4bb1f51ded8b432c5bc3c5968bd
libtiff-debugsource-4.0.9-17.el8.s390x.rpm SHA-256: fa4cce12fb4fcc8fd2b9fd1b525ed6961688eb2da6712763acd77639ddd23a44
libtiff-tools-4.0.9-17.el8.s390x.rpm SHA-256: f3aee6aa1e2a7cb53ccb95b2731f566246f1929139a572e0b1edb9e280593b10
libtiff-tools-debuginfo-4.0.9-17.el8.s390x.rpm SHA-256: a86a5102924cac8c2c608dbb0added05e686aee5b5c2987f80aa06c378aca3bf

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.