Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

In plain English

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat AI Inference Server 3.2; Red Hat Discovery 2; and 1 more. Affected products named by the advisory: Red Hat Enterprise Linux 8. Successful exploitation can interrupt the affected service or exhaust resources, reducing availability until the component recovers.

Vulnerable items

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat AI Inference Server 3.2 — Red Hat AI Inference Server 3.2 is a Red Hat Linux server component identified as affected by the official advisory.
• Red Hat Discovery 2
• Red Hat Enterprise Linux 8

Recommended action

Primary action: update to a vendor-listed fixed release: 4.6.0.