Loading story…
Red Hat released RHSA-2024:5079 for Red Hat Enterprise Linux 8 and RHEL 8.10 Extended Life Cycle, updating libtiff to remediate four crafted-TIFF vulnerabilities: CVE-2018-15209, CVE-2023-25433, CVE-2023-6228, and CVE-2023-52356. The updated packages are available for x86_64, s390x, ppc64le, and aarch64; related tools packages are provided through CodeReady Linux Builder.
The flaws are heap-based buffer overflows in libtiff APIs and utilities, including tiff2pdf, tiffcp, and tiffcrop. Processing a malicious TIFF can crash affected programs and cause denial of service; CVE-2023-25433 stems from incorrect buffer-size updating after rotateImage() in tiffcrop. Red Hat assessed the issues primarily as requiring crafted-file processing and rated the advisory Moderate, while support and remediation status varies across RHEL releases and the compat-libtiff3 package.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2026:7081, providing a fixed libtiff package for Red Hat Enterprise Linux 10 to remediate CVE-2023-52356.
Red Hat released RHSA-2026:5958 with a fixed libtiff package for the Red Hat Enterprise Linux 9.6 Extended Update Support stream.
Red Hat released RHSA-2025:20801, providing a fixed libtiff package for Red Hat Enterprise Linux 9 to address CVE-2023-52356.
Red Hat issued RHBA-2024:5568 updating RHEL 8-based Middleware Container images, including JBoss EAP 7.4 OpenJDK 17 OpenShift and runtime images, with fixes from RHSA-2024:5079 for four libtiff vulnerabilities. Customers were advised to retrieve the updated images, update Dockerfiles or scripts, and rebuild dependent container images.
Red Hat issued RHBA-2024:5567 to update RHEL 8-based Middleware Containers container images with the libtiff security fixes from RHSA-2024:5079, covering CVE-2018-15209, CVE-2023-25433, CVE-2023-6228, and CVE-2023-52356. Red Hat advised customers to pull the updated images and rebuild dependent container images.
Red Hat issued RHBA-2024:5483 to update the RHEL 8 rhel8/go-toolset and ubi8/go-toolset container images with fixes from RHSA-2024:5079 for four libtiff vulnerabilities, including CVE-2023-6228 and CVE-2023-52356. Users were advised to upgrade the images and rebuild dependent container images.
Red Hat issued RHBA-2024:5449, updating RHEL 8 container images to incorporate the libtiff security fixes from RHSA-2024:5079, including CVE-2023-6228 and CVE-2023-52356. Red Hat advised users to upgrade their base images and rebuild dependent container images.
Red Hat issued RHBA-2024:5087 to update OpenShift Dev Spaces 3 container images with backported fixes from RHSA-2024:5079 for four libtiff vulnerabilities, including CVE-2018-15209, CVE-2023-6228, and CVE-2023-52356. Users were advised to upgrade the images and rebuild dependent container images.
Red Hat issued RHSA-2024:5079, a Moderate-security libtiff update for RHEL 8 and RHEL 8.10 Extended Life Cycle deployments. The update remediated CVE-2018-15209, CVE-2023-25433, CVE-2023-6228, and CVE-2023-52356.
Red Hat released RHSA-2024:2289 for Red Hat Enterprise Linux 9, providing a libtiff fix for CVE-2023-6228, a heap-based buffer overflow in tiffcp's cpStripToTile() function.
Red Hat published CVE-2023-52356, describing a heap-based buffer overflow in libtiff's TIFFReadRGBATileExt() API that can be triggered by a crafted TIFF file to crash an affected program.
Guilherme de Almeida Suckevicz reported CVE-2023-6228, a heap-based buffer overflow in libtiff's tiffcp cpStripToTile() function. A crafted TIFF file processed by tiffcp can trigger an application crash.
Laura Pardo reported CVE-2018-15209 to Red Hat as Bugzilla 1614051. The flaw is a heap-based buffer overflow in LibTIFF's ChopUpSingleUncompressedStrip function that a crafted TIFF file can trigger, causing an application crash or denial of service.
Red Hat released RHSA-2026:7304 with a fixed libtiff package for the Red Hat Enterprise Linux 10.0 Extended Update Support stream.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Moderate-severity advisories for **CVE-2023-52356**, a `libtiff` flaw in `TIFFReadRGBATileExt()` that can trigger a segmentation fault and denial of service when a system processes a crafted TIFF file. Fixed packages include `libtiff-4.4.0-13.el9_6.3` for supported RHEL 9.6 channels, `libtiff-4.4.0-15.el9` for supported RHEL 9 releases, and `libtiff-4.6.0-6.el10_0.2` and `libtiff-4.6.0-6.el10_1.2` for RHEL 10.0 and 10.1 channels, respectively, across x86_64, aarch64, ppc64le, and s390x. The remediation also follows earlier RHEL 8 container-image updates for Middleware, CUPS, and Camel K Operator deployments, which incorporated fixes for `CVE-2023-52356` alongside libtiff heap-overflow issues `CVE-2018-15209`, `CVE-2023-25433`, and `CVE-2023-6228`. Organizations should apply the relevant RHEL updates and, for affected OpenShift and RHEL 8 container environments, pull revised base images and rebuild dependent images to ensure vulnerable libtiff components are replaced.
Aug 26, 2026
Red Hat released **Important** security updates for `libtiff` to address **CVE-2026-12912**, a heap-based buffer overflow that can be triggered by a crafted PixarLog-compressed TIFF image. The flaw occurs when decoding images with `PIXARLOGDATAFMT_8BITABGR` and a stride of 3: `horizontalAccumulate8abgr` expands 3-byte input triplets into 4-byte output pixels, while `PixarLogDecode` advances the output pointer by only 3 bytes. Because `TIFFScanlineSize` can also return an undersized buffer for this configuration, applications that allocate buffers according to documented guidance may write past the end of the heap buffer by roughly one image-width byte per scan line. The issue affects applications that explicitly select the vulnerable output format and read PixarLog-compressed TIFF files with `SamplesPerPixel=3`, while `TIFFReadRGBAImage` is not directly affected. Red Hat said the bug has been addressed across multiple supported product streams, including **RHEL 9.4**, **RHEL 9.2**, and **RHEL 8.6** support channels, with updated packages such as `libtiff-4.4.0-12.el9_4.6`, `libtiff-4.4.0-8.el9_2.6`, and `libtiff-4.0.9-21.el8_6.3` released for affected architectures and variants including SAP, AUS, EUS, and Extended Life Cycle offerings.
Sep 1, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026