{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "Build the rhel7-els target with dist .el7_9 to match the RHEL 7 ELS\n vendor package suffix", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/advisories/2026/clsa-2026_1792158760.json" } ], "tracking": { "current_release_date": "2026-10-20T22:07:12Z", "generator": { "date": "2026-10-20T22:07:12Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792158760", "initial_release_date": "2026-10-16T13:52:41Z", "revision_history": [ { "date": "2026-10-16T13:52:41Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-20T22:07:12Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "libtiff: Fix of 13 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product": { "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_id": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-static@4.0.3-35.0.1.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product": { "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_id": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-devel@4.0.3-35.0.1.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product": { "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_id": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-tools@4.0.3-35.0.1.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product": { "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_id": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff@4.0.3-35.0.1.el7.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product": { "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_id": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-static@4.0.3-35.0.1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product": { "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_id": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-devel@4.0.3-35.0.1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product": { "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_id": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff-tools@4.0.3-35.0.1.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product": { "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_id": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libtiff@4.0.3-35.0.1.el7.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686" }, "product_reference": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" }, "product_reference": "libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" }, "product_reference": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686" }, "product_reference": "libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686" }, "product_reference": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" }, "product_reference": "libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686" }, "product_reference": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" }, "product_reference": "libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-5225", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-5225" }, { "category": "external", "summary": "http://bugzilla.maptools.org/show_bug.cgi?id=2656", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2656" }, { "category": "external", "summary": "http://bugzilla.maptools.org/show_bug.cgi?id=2657", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2657" }, { "category": "external", "summary": "http://www.debian.org/security/2017/dsa-3844", "url": "http://www.debian.org/security/2017/dsa-3844" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/95413", "url": "http://www.securityfocus.com/bid/95413" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1037911", "url": "http://www.securitytracker.com/id/1037911" }, { "category": "external", "summary": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7", "url": "https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/201709-27", "url": "https://security.gentoo.org/glsa/201709-27" } ], "release_date": "2017-01-12T11:59:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-8177", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-8177" }, { "category": "external", "summary": "http://www.libtiff.org/", "url": "http://www.libtiff.org/" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22", "url": "https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/715", "url": "https://gitlab.com/libtiff/libtiff/-/issues/715" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/737", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/737" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.317591", "url": "https://vuldb.com/?ctiid.317591" }, { "category": "external", "summary": "https://vuldb.com/?id.317591", "url": "https://vuldb.com/?id.317591" }, { "category": "external", "summary": "https://vuldb.com/?submit.621797", "url": "https://vuldb.com/?submit.621797" } ], "release_date": "2025-07-26T04:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52355", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52355" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:20801", "url": "https://access.redhat.com/errata/RHSA-2025:20801" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21994", "url": "https://access.redhat.com/errata/RHSA-2025:21994" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23078", "url": "https://access.redhat.com/errata/RHSA-2025:23078" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23079", "url": "https://access.redhat.com/errata/RHSA-2025:23079" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23080", "url": "https://access.redhat.com/errata/RHSA-2025:23080" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3461", "url": "https://access.redhat.com/errata/RHSA-2026:3461" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3462", "url": "https://access.redhat.com/errata/RHSA-2026:3462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41892", "url": "https://access.redhat.com/errata/RHSA-2026:41892" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:43537", "url": "https://access.redhat.com/errata/RHSA-2026:43537" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49671", "url": "https://access.redhat.com/errata/RHSA-2026:49671" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73909", "url": "https://access.redhat.com/errata/RHSA-2026:73909" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73959", "url": "https://access.redhat.com/errata/RHSA-2026:73959" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73960", "url": "https://access.redhat.com/errata/RHSA-2026:73960" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73961", "url": "https://access.redhat.com/errata/RHSA-2026:73961" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73962", "url": "https://access.redhat.com/errata/RHSA-2026:73962" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74458", "url": "https://access.redhat.com/errata/RHSA-2026:74458" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74459", "url": "https://access.redhat.com/errata/RHSA-2026:74459" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74460", "url": "https://access.redhat.com/errata/RHSA-2026:74460" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74461", "url": "https://access.redhat.com/errata/RHSA-2026:74461" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74462", "url": "https://access.redhat.com/errata/RHSA-2026:74462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74463", "url": "https://access.redhat.com/errata/RHSA-2026:74463" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74674", "url": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2023-52355", "url": "https://access.redhat.com/security/cve/CVE-2023-52355" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/621", "url": "https://gitlab.com/libtiff/libtiff/-/issues/621" } ], "release_date": "2024-01-25T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52356", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52356" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:5079", "url": "https://access.redhat.com/errata/RHSA-2024:5079" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:20801", "url": "https://access.redhat.com/errata/RHSA-2025:20801" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21994", "url": "https://access.redhat.com/errata/RHSA-2025:21994" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23078", "url": "https://access.redhat.com/errata/RHSA-2025:23078" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23079", "url": "https://access.redhat.com/errata/RHSA-2025:23079" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23080", "url": "https://access.redhat.com/errata/RHSA-2025:23080" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16174", "url": "https://access.redhat.com/errata/RHSA-2026:16174" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25096", "url": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3461", "url": "https://access.redhat.com/errata/RHSA-2026:3461" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3462", "url": "https://access.redhat.com/errata/RHSA-2026:3462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5958", "url": "https://access.redhat.com/errata/RHSA-2026:5958" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7081", "url": "https://access.redhat.com/errata/RHSA-2026:7081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7304", "url": "https://access.redhat.com/errata/RHSA-2026:7304" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7335", "url": "https://access.redhat.com/errata/RHSA-2026:7335" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8746", "url": "https://access.redhat.com/errata/RHSA-2026:8746" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8747", "url": "https://access.redhat.com/errata/RHSA-2026:8747" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8748", "url": "https://access.redhat.com/errata/RHSA-2026:8748" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2023-52356", "url": "https://access.redhat.com/security/cve/CVE-2023-52356" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2251344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251344" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/622", "url": "https://gitlab.com/libtiff/libtiff/-/issues/622" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/16", "url": "http://seclists.org/fulldisclosure/2024/Jul/16" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/17", "url": "http://seclists.org/fulldisclosure/2024/Jul/17" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/18", "url": "http://seclists.org/fulldisclosure/2024/Jul/18" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/19", "url": "http://seclists.org/fulldisclosure/2024/Jul/19" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/20", "url": "http://seclists.org/fulldisclosure/2024/Jul/20" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/21", "url": "http://seclists.org/fulldisclosure/2024/Jul/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/22", "url": "http://seclists.org/fulldisclosure/2024/Jul/22" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2024/Jul/23", "url": "http://seclists.org/fulldisclosure/2024/Jul/23" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214116", "url": "https://support.apple.com/kb/HT214116" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214117", "url": "https://support.apple.com/kb/HT214117" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214118", "url": "https://support.apple.com/kb/HT214118" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214119", "url": "https://support.apple.com/kb/HT214119" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214120", "url": "https://support.apple.com/kb/HT214120" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214122", "url": "https://support.apple.com/kb/HT214122" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214123", "url": "https://support.apple.com/kb/HT214123" }, { "category": "external", "summary": "https://support.apple.com/kb/HT214124", "url": "https://support.apple.com/kb/HT214124" } ], "release_date": "2024-01-25T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-61144", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-61144" }, { "category": "external", "summary": "https://gist.github.com/optionGo/5ad17e96a0a40f03578dd6c9f8645952", "url": "https://gist.github.com/optionGo/5ad17e96a0a40f03578dd6c9f8645952" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/commit/09f53a86cf26dfd961925227e59e180db617f26d", "url": "https://gitlab.com/libtiff/libtiff/-/commit/09f53a86cf26dfd961925227e59e180db617f26d" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/commit/88cf9dbb48f6e172629795ecffae35d5052f68aa", "url": "https://gitlab.com/libtiff/libtiff/-/commit/88cf9dbb48f6e172629795ecffae35d5052f68aa" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/740", "url": "https://gitlab.com/libtiff/libtiff/-/issues/740" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/757", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/757" } ], "release_date": "2026-02-23T19:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2017-9117", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-9117" }, { "category": "external", "summary": "http://bugzilla.maptools.org/show_bug.cgi?id=2690", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2690" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/98581", "url": "http://www.securityfocus.com/bid/98581" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/89", "url": "https://gitlab.com/libtiff/libtiff/-/issues/89" }, { "category": "external", "summary": "https://usn.ubuntu.com/3606-1/", "url": "https://usn.ubuntu.com/3606-1/" } ], "release_date": "2017-05-21T19:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-12912", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-12912" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:34890", "url": "https://access.redhat.com/errata/RHSA-2026:34890" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:41892", "url": "https://access.redhat.com/errata/RHSA-2026:41892" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:42668", "url": "https://access.redhat.com/errata/RHSA-2026:42668" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47183", "url": "https://access.redhat.com/errata/RHSA-2026:47183" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47184", "url": "https://access.redhat.com/errata/RHSA-2026:47184" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49671", "url": "https://access.redhat.com/errata/RHSA-2026:49671" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:50774", "url": "https://access.redhat.com/errata/RHSA-2026:50774" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54638", "url": "https://access.redhat.com/errata/RHSA-2026:54638" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54640", "url": "https://access.redhat.com/errata/RHSA-2026:54640" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:54642", "url": "https://access.redhat.com/errata/RHSA-2026:54642" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:58545", "url": "https://access.redhat.com/errata/RHSA-2026:58545" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:58553", "url": "https://access.redhat.com/errata/RHSA-2026:58553" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:58554", "url": "https://access.redhat.com/errata/RHSA-2026:58554" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:58556", "url": "https://access.redhat.com/errata/RHSA-2026:58556" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:61657", "url": "https://access.redhat.com/errata/RHSA-2026:61657" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:69292", "url": "https://access.redhat.com/errata/RHSA-2026:69292" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73909", "url": "https://access.redhat.com/errata/RHSA-2026:73909" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73959", "url": "https://access.redhat.com/errata/RHSA-2026:73959" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73960", "url": "https://access.redhat.com/errata/RHSA-2026:73960" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73961", "url": "https://access.redhat.com/errata/RHSA-2026:73961" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:73962", "url": "https://access.redhat.com/errata/RHSA-2026:73962" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74458", "url": "https://access.redhat.com/errata/RHSA-2026:74458" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74459", "url": "https://access.redhat.com/errata/RHSA-2026:74459" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74460", "url": "https://access.redhat.com/errata/RHSA-2026:74460" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74461", "url": "https://access.redhat.com/errata/RHSA-2026:74461" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74462", "url": "https://access.redhat.com/errata/RHSA-2026:74462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74463", "url": "https://access.redhat.com/errata/RHSA-2026:74463" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74674", "url": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:83550", "url": "https://access.redhat.com/errata/RHSA-2026:83550" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-12912", "url": "https://access.redhat.com/security/cve/CVE-2026-12912" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824", "url": "https://gitlab.com/libtiff/libtiff/-/work_items/824" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json" } ], "release_date": "2026-06-29T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-9900", "cwe": { "id": "CWE-123", "name": "Write-what-where Condition" }, "notes": [ { "category": "description", "text": "A flaw was found in Libtiff. This vulnerability is a \"write-what-where\" condition, triggered when the library processes a specially crafted TIFF image file.\n\nBy providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-9900" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17651", "url": "https://access.redhat.com/errata/RHSA-2025:17651" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17675", "url": "https://access.redhat.com/errata/RHSA-2025:17675" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17710", "url": "https://access.redhat.com/errata/RHSA-2025:17710" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17738", "url": "https://access.redhat.com/errata/RHSA-2025:17738" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17739", "url": "https://access.redhat.com/errata/RHSA-2025:17739" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:17740", "url": "https://access.redhat.com/errata/RHSA-2025:17740" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19113", "url": "https://access.redhat.com/errata/RHSA-2025:19113" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19156", "url": "https://access.redhat.com/errata/RHSA-2025:19156" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19276", "url": "https://access.redhat.com/errata/RHSA-2025:19276" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19906", "url": "https://access.redhat.com/errata/RHSA-2025:19906" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19947", "url": "https://access.redhat.com/errata/RHSA-2025:19947" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:20956", "url": "https://access.redhat.com/errata/RHSA-2025:20956" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:20998", "url": "https://access.redhat.com/errata/RHSA-2025:20998" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21060", "url": "https://access.redhat.com/errata/RHSA-2025:21060" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21061", "url": "https://access.redhat.com/errata/RHSA-2025:21061" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21062", "url": "https://access.redhat.com/errata/RHSA-2025:21062" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21407", "url": "https://access.redhat.com/errata/RHSA-2025:21407" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21506", "url": "https://access.redhat.com/errata/RHSA-2025:21506" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21507", "url": "https://access.redhat.com/errata/RHSA-2025:21507" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21508", "url": "https://access.redhat.com/errata/RHSA-2025:21508" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:21994", "url": "https://access.redhat.com/errata/RHSA-2025:21994" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23078", "url": "https://access.redhat.com/errata/RHSA-2025:23078" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23079", "url": "https://access.redhat.com/errata/RHSA-2025:23079" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:23080", "url": "https://access.redhat.com/errata/RHSA-2025:23080" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:0001", "url": "https://access.redhat.com/errata/RHSA-2026:0001" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:0076", "url": "https://access.redhat.com/errata/RHSA-2026:0076" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:0077", "url": "https://access.redhat.com/errata/RHSA-2026:0077" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:0078", "url": "https://access.redhat.com/errata/RHSA-2026:0078" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3461", "url": "https://access.redhat.com/errata/RHSA-2026:3461" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3462", "url": "https://access.redhat.com/errata/RHSA-2026:3462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7504", "url": "https://access.redhat.com/errata/RHSA-2026:7504" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2025-9900", "url": "https://access.redhat.com/security/cve/CVE-2025-9900" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2392784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392784" }, { "category": "external", "summary": "https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file", "url": "https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/704", "url": "https://gitlab.com/libtiff/libtiff/-/issues/704" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/732", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/732" }, { "category": "external", "summary": "https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html", "url": "https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2025/09/26/3", "url": "http://www.openwall.com/lists/oss-security/2025/09/26/3" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html" } ], "release_date": "2025-09-23T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-3970", "notes": [ { "category": "description", "text": "A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-3970" }, { "category": "external", "summary": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be", "url": "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html", "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html" }, { "category": "external", "summary": "https://oss-fuzz.com/download?testcase_id=5738253143900160", "url": "https://oss-fuzz.com/download?testcase_id=5738253143900160" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221215-0009/", "url": "https://security.netapp.com/advisory/ntap-20221215-0009/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213841", "url": "https://support.apple.com/kb/HT213841" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213843", "url": "https://support.apple.com/kb/HT213843" }, { "category": "external", "summary": "https://vuldb.com/?id.213549", "url": "https://vuldb.com/?id.213549" } ], "release_date": "2022-11-13T08:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-7006", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-7006" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6360", "url": "https://access.redhat.com/errata/RHSA-2024:6360" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:8833", "url": "https://access.redhat.com/errata/RHSA-2024:8833" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:8914", "url": "https://access.redhat.com/errata/RHSA-2024:8914" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2024-7006", "url": "https://access.redhat.com/security/cve/CVE-2024-7006" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2302996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302996" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240920-0001/", "url": "https://security.netapp.com/advisory/ntap-20240920-0001/" } ], "release_date": "2024-08-12T13:38:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-8176", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-8176" }, { "category": "external", "summary": "http://www.libtiff.org/", "url": "http://www.libtiff.org/" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172", "url": "https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/707", "url": "https://gitlab.com/libtiff/libtiff/-/issues/707" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/727", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/727" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.317590", "url": "https://vuldb.com/?ctiid.317590" }, { "category": "external", "summary": "https://vuldb.com/?id.317590", "url": "https://vuldb.com/?id.317590" }, { "category": "external", "summary": "https://vuldb.com/?submit.621796", "url": "https://vuldb.com/?submit.621796" } ], "release_date": "2025-07-26T04:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-0891", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-0891" }, { "category": "external", "summary": "https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c", "url": "https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c" }, { "category": "external", "summary": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/380", "url": "https://gitlab.com/libtiff/libtiff/-/issues/380" }, { "category": "external", "summary": "https://gitlab.com/libtiff/libtiff/-/issues/382", "url": "https://gitlab.com/libtiff/libtiff/-/issues/382" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202210-10", "url": "https://security.gentoo.org/glsa/202210-10" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221228-0008/", "url": "https://security.netapp.com/advisory/ntap-20221228-0008/" }, { "category": "external", "summary": "https://www.debian.org/security/2022/dsa-5108", "url": "https://www.debian.org/security/2022/dsa-5108" } ], "release_date": "2022-03-10T17:44:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-4775", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-4775" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12265", "url": "https://access.redhat.com/errata/RHSA-2026:12265" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:12271", "url": "https://access.redhat.com/errata/RHSA-2026:12271" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14929", "url": "https://access.redhat.com/errata/RHSA-2026:14929" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16055", "url": "https://access.redhat.com/errata/RHSA-2026:16055" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19150", "url": "https://access.redhat.com/errata/RHSA-2026:19150" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19363", "url": "https://access.redhat.com/errata/RHSA-2026:19363" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19585", "url": "https://access.redhat.com/errata/RHSA-2026:19585" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19586", "url": "https://access.redhat.com/errata/RHSA-2026:19586" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19604", "url": "https://access.redhat.com/errata/RHSA-2026:19604" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19608", "url": "https://access.redhat.com/errata/RHSA-2026:19608" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19609", "url": "https://access.redhat.com/errata/RHSA-2026:19609" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19657", "url": "https://access.redhat.com/errata/RHSA-2026:19657" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19659", "url": "https://access.redhat.com/errata/RHSA-2026:19659" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19702", "url": "https://access.redhat.com/errata/RHSA-2026:19702" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20583", "url": "https://access.redhat.com/errata/RHSA-2026:20583" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20585", "url": "https://access.redhat.com/errata/RHSA-2026:20585" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20591", "url": "https://access.redhat.com/errata/RHSA-2026:20591" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:20592", "url": "https://access.redhat.com/errata/RHSA-2026:20592" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:24992", "url": "https://access.redhat.com/errata/RHSA-2026:24992" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25096", "url": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25910", "url": "https://access.redhat.com/errata/RHSA-2026:25910" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30078", "url": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30087", "url": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30088", "url": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30089", "url": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30349", "url": "https://access.redhat.com/errata/RHSA-2026:30349" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33388", "url": "https://access.redhat.com/errata/RHSA-2026:33388" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:74674", "url": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-4775", "url": "https://access.redhat.com/security/cve/CVE-2026-4775" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html", "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-16T13:52:41.823403Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760", "product_ids": [ "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-devel-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-static-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.i686", "CloudLinux-7:libtiff-tools-0:4.0.3-35.0.1.el7.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792158760" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }