CVE-2023-52356

Thursday, January 25, 2024

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

Affected Software

Vendor	Product	Version Range	Status
		`0 < 4.6.0`	affected
Red Hat	Red Hat Enterprise Linux 10	`0:4.6.0-6.el10_1.2 < *`	unaffected
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	`0:4.6.0-6.el10_0.2 < *`	unaffected
Red Hat	Red Hat Enterprise Linux 8	`0:4.0.9-32.el8_10 < *`	unaffected
Red Hat	Red Hat Enterprise Linux 9	`0:4.4.0-15.el9 < *`	unaffected
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	`0:4.4.0-13.el9_6.3 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`3.2.2-1765379088 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`3.2.2-1765379049 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`3.2.2-1764871796 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`1780681984 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`1772160593 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`1772160625 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.2	`1775740563 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1778244546 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1775680192 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1775680262 < *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1775749857 < *`	unaffected
Red Hat	Red Hat Discovery 2	`2.4.0-1763656152 < *`	unaffected

Weaknesses

CWE-122: Heap-based Buffer Overflow

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

SSVC:
Exploitation: poc
- Automatable: yes
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.