UbuntuUpdates.org

Package "tiff"

Name: tiff

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Tag Image File Format library (TIFF), development files
  • TIFF manipulation and conversion documentation
  • Tag Image File Format (TIFF) library
  • Tag Image File Format library (TIFF), development files (transitional package)
Latest version: 4.4.0-4ubuntu3.2
Release: kinetic (22.10)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "tiff" in Kinetic

Repository Area Version
base main 4.4.0-4ubuntu3
base universe 4.4.0-4ubuntu3
security main 4.4.0-4ubuntu3.2
security universe 4.4.0-4ubuntu3.2
updates universe 4.4.0-4ubuntu3.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 4.4.0-4ubuntu3.2 2022-12-01 19:07:24 UTC

  tiff (4.4.0-4ubuntu3.2) kinetic-security; urgency=critical

  * Backport security fix for CVE-2022-3970, fix (unsigned) integer overflow
    on strips/tiles > 2 GB in TIFFReadRGBATileExt() (closes: #1024737).

 -- Rico Tzschichholz <email address hidden> Wed, 30 Nov 2022 16:24:00 +0100
Source diff to previous version
1024737 tiff: CVE-2022-3970: TIFFReadRGBATileExt(): fix (unsigned) integer overflow on strips/tiles > 2 GB
CVE-2022-3970 A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getim

Version: 4.4.0-4ubuntu3.1 2022-11-08 06:07:36 UTC

  tiff (4.4.0-4ubuntu3.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: heap-overflow and double free in tiffcrop
    - debian/patches/CVE-2022-2519_2520_2521_2953.patch: Add checks and ends
      tiffcrop if -S arguments are not mutually exclusive.
    - CVE-2022-2519
    - CVE-2022-2520
    - CVE-2022-2521
    - CVE-2022-2953
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2022-3570_3598.patch: increases buffer sizes for
      subroutines in tools/tiffcrop.c.
    - CVE-2022-3570
    - CVE-2022-3598
  * SECURITY UPDATE: out-of-bound write in tiffcrop
    - debian/patches/CVE-2022-3599.patch: Revised handling of TIFFTAG_INKNAMES
      and related TIFFTAG_NUMBEROFINKS value
    - CVE-2022-3599
  * SECURITY UPDATE: out-of-bound write in tif_unix
    - debian/patches/CVE-2022-3626_3627.patch: disable incompatibility of -Z,
      -X, -Y, -z options with any PAGE_MODE_x option
    - CVE-2022-3626
    - CVE-2022-3627

 -- Nishit Majithia <email address hidden> Wed, 02 Nov 2022 14:13:19 +0530
CVE-2022-2519 There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
CVE-2022-2520 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when readi
CVE-2022-2521 It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can
CVE-2022-2953 LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafte
CVE-2022-3570 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory acces
CVE-2022-3598 LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-servi
CVE-2022-3599 LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted
CVE-2022-3626 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allo
CVE-2022-3627 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowi


About   -   Send Feedback to @ubuntu_updates