Описание
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
A flaw was found in libtiff. An attacker can exploit a vulnerability in the process_command_opts() function within tools/tiffcrop.c to execute arbitrary code. This could lead to a complete compromise of the affected system.
Отчет
Red Hat has classified this flaw as Important rather than Moderate because an attacker who convinces a user or automated process to run the utility with crafted arguments could execute arbitrary instructions in the security context of the invoking account. This issue is isolated to the standalone tiffcrop binary and does not reside in the core libtiff shared library, meaning third-party software and background system daemons dynamically linked against libtiff remain unaffected. Exploitation requires specific invocation of the CLI tool with malicious command-line options, significantly limiting direct exposure in standard server deployments where the utility is not integrated into automated pipelines.
Меры по смягчению последствий
Avoid using the tiffcrop utility to process TIFF image files from untrusted sources. If the libtiff-tools package, which provides tiffcrop, is not required, consider removing it to prevent exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libtiff | Not affected | ||
| Red Hat Enterprise Linux 6 | libtiff | Out of support scope | ||
| Red Hat Enterprise Linux 7 | compat-libtiff3 | Not affected | ||
| Red Hat Enterprise Linux 7 | libtiff | Affected | ||
| Red Hat Enterprise Linux 8 | compat-libtiff3 | Not affected | ||
| Red Hat Enterprise Linux 8 | mingw-libtiff | Affected | ||
| Red Hat Enterprise Linux 9 | libtiff | Not affected | ||
| Red Hat Enterprise Linux 8 | libtiff | Fixed | RHSA-2026:69095 | 21.09.2026 |
| Red Hat Hardened Images | libtiff-main-4.7.2-2.hum1 | Fixed | RHSA-2026:53467 | 11.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an ...
EPSS
7.3 High
CVSS3