SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3690

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3690

Security update for tiff

Type: security

Severity: important

Issued: 2022-10-21

Description:

This update for tiff fixes the following issues:

- CVE-2022-2519: Fixed a double free in rotateImage() (bsc#1202968).
- CVE-2022-2520: Fixed a assertion failure in rotateImage() (bsc#1202973).
- CVE-2022-2521: Fixed invalid free in TIFFClose() (bsc#1202971).
- CVE-2022-2867: Fixed out of bounds read and write in tiffcrop.c (bsc#1202466).
- CVE-2022-2868: Fixed out of bounds read in reverseSamples16bits() (bsc#1202467).
- CVE-2022-2869: Fixed out of bounds read and write in extractContigSamples8bits() (bsc#1202468).
- CVE-2022-34526: Fixed stack overflow in the _TIFFVGetField function of Tiffsplit (bsc#1202026).

References

CVE: CVE-2022-34526
CVE: CVE-2022-34266
CVE: CVE-2022-2869
CVE: CVE-2022-2868
CVE: CVE-2022-2867
CVE: CVE-2022-2521
CVE: CVE-2022-2520
CVE: CVE-2022-2519
CVE: CVE-2022-0561
Bugzilla: 1202973 VUL-0: CVE-2022-2520: tiff: assertion fail in rotateImage() function at tiffcrop.c
Bugzilla: 1202971 VUL-0: CVE-2022-2521: tiff: Invalid pointer free operation in TIFFClose() at tif_close.c
Bugzilla: 1202968 VUL-0: CVE-2022-2519: tiff: double free or corruption in rotateImage() function at tiffcrop.c
Bugzilla: 1202468 VUL-0: CVE-2022-2869: tiff: tiffcrop.c has uint32_t underflow which leads to out of bounds read and write in extractContigSamples8bits()
Bugzilla: 1202467 VUL-0: CVE-2022-2868: tiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in reverseSamples16bits()
Bugzilla: 1202466 VUL-0: CVE-2022-2867: tiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c
Bugzilla: 1202026 VUL-0: CVE-2022-34526: tiff: stack overflow in the _TIFFVGetField function of Tiffsplit
Bugzilla: 1201971 CVE-2022-34266 on SLES 12 SP2 Reactive LTSS: tiff
Bugzilla: 1201723 VUL-0: CVE-2022-34266: tiff: invalid range may be passed as an argument to the memset() function

Packages

tiff-4.0.9-150000.45.16.1