Most recent entries from all

ALSA-2022:7585 — Moderate: libtiff security update

Affected: AlmaLinux:8: libtiff, AlmaLinux:8: libtiff-devel, AlmaLinux:8: libtiff-tools

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562) * libtiff: reachable assertion (CVE-2022-0865) * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924) * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355) * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844) * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891) * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908) * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-05758

Withdrawn: BELL-CVE-2022-0562 — CVE-2022-0562 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-1103

EUVD-2026-11058

fkie_cve-2022-0562

Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.

GHSA-6ph5-gf8v-wvm9

gsd-2022-0562

msrc_CVE-2022-0562 — Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff v…

msrc_CVE-2022-0562

OESA-2022-1551 — libtiff security update

Affected: openEuler:20.03-LTS-SP1: libtiff, openEuler:20.03-LTS-SP2: libtiff, openEuler:20.03-LTS-SP3: libtiff

TIFF Library and Utilities. Security Fix(es): Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.(CVE-2022-0562) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.(CVE-2022-0561)

openSUSE-SU-2024:12057-1 — libtiff-devel-32bit-4.3.0-1.6 on GA media

libtiff-devel-32bit-4.3.0-1.6 on GA media

SUSE-SU-2022:1667-1 — Security update for tiff

Security update for tiff

UBUNTU-CVE-2022-0562

Affected: Ubuntu:Pro:14.04:LTS: tiff, Ubuntu:Pro:16.04:LTS: tiff, Ubuntu:18.04:LTS: tiff, Ubuntu:20.04:LTS: tiff

WID-SEC-W-2022-0150 — libTIFF: Mehrere Schwachstellen ermöglichen Denial of Service

Ein lokaler Angreifer kann mehrere Schwachstellen in libTIFF ausnutzen, um einen Denial of Service Angriff durchzuführen.