ArchLinux: 202204-6: libtiff: multiple issues | LinuxSecurity.com
Arch Linux Security Advisory ASA-202204-6
=========================================

Severity: High
Date    : 2022-04-05
CVE-ID  : CVE-2022-0561  CVE-2022-0562 CVE-2022-0865 CVE-2022-0891
           CVE-2022-0907  CVE-2022-0908 CVE-2022-0909 CVE-2022-0924
           CVE-2022-22844
Package : libtiff
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2658

Summary
=======

The package libtiff before version 4.3.0-2 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
==========

Upgrade to 4.3.0-2.

# pacman -Syu "libtiff>=4.3.0-2"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

- CVE-2022-0561 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0
to 4.3.0 could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0562 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to
4.3.0 could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0865 (denial of service)

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.

- CVE-2022-0891 (arbitrary code execution)

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in
libtiff library Version 4.3.0 allows attacker to trigger unsafe or out
of bounds memory access via crafted TIFF image file which could result
into application crash, potential information disclosure or any other
context-dependent impact.

- CVE-2022-0907 (denial of service)

Unchecked Return Value to NULL Pointer Dereference in tiffcrop in
libtiff 4.3.0 allows attackers to cause a denial-of-service via a
crafted tiff file.

- CVE-2022-0908 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0
could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0909 (denial of service)

A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers
to cause a denial-of-service via a crafted tiff file.

- CVE-2022-0924 (denial of service)

Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.

- CVE-2022-22844 (denial of service)

LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in
certain situations involving a custom tag and 0x0200 as the second word
of the DE field.

Impact
======

A remote attacker is able to crash the application or execute arbitrary
code on the affected host via a crafted tiff file.

References
==========

https://bugs.archlinux.org/task/74229
https://gitlab.com/libtiff/libtiff/-/issues/362
https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b
https://gitlab.com/libtiff/libtiff/-/issues/385
https://gitlab.com/libtiff/libtiff/-/merge_requests/306
https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067
https://gitlab.com/libtiff/libtiff/-/issues/380
https://gitlab.com/libtiff/libtiff/-/issues/382
https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
https://gitlab.com/libtiff/libtiff/-/issues/392
https://gitlab.com/libtiff/libtiff/-/merge_requests/314
https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc
https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85
https://gitlab.com/libtiff/libtiff/-/issues/383
https://gitlab.com/libtiff/libtiff/-/issues/393
https://gitlab.com/libtiff/libtiff/-/merge_requests/310
https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde
https://gitlab.com/libtiff/libtiff/-/issues/278
https://gitlab.com/libtiff/libtiff/-/merge_requests/311
https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a
https://gitlab.com/libtiff/libtiff/-/issues/355
https://gitlab.com/libtiff/libtiff/-/merge_requests/287
https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64
https://security.archlinux.org/CVE-2022-0561
https://security.archlinux.org/CVE-2022-0562
https://security.archlinux.org/CVE-2022-0865
https://security.archlinux.org/CVE-2022-0891
https://security.archlinux.org/CVE-2022-0907
https://security.archlinux.org/CVE-2022-0908
https://security.archlinux.org/CVE-2022-0909
https://security.archlinux.org/CVE-2022-0924
https://security.archlinux.org/CVE-2022-22844

ArchLinux: 202204-6: libtiff: multiple issues

April 7, 2022
The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service

Summary

- CVE-2022-0561 (denial of service)
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file.
- CVE-2022-0562 (denial of service)
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file.
- CVE-2022-0865 (denial of service)
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.
- CVE-2022-0891 (arbitrary code execution)
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact.
- CVE-2022-0907 (denial of service)
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.
- CVE-2022-0908 (denial of service)
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
- CVE-2022-0909 (denial of service)
A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.
- CVE-2022-0924 (denial of service)
Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.
- CVE-2022-22844 (denial of service)
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.

Resolution

Upgrade to 4.3.0-2.
# pacman -Syu "libtiff>=4.3.0-2"
The problems have been fixed upstream but no release is available yet.

References

https://bugs.archlinux.org/task/74229 https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b https://gitlab.com/libtiff/libtiff/-/issues/385 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067 https://gitlab.com/libtiff/libtiff/-/issues/380 https://gitlab.com/libtiff/libtiff/-/issues/382 https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85 https://gitlab.com/libtiff/libtiff/-/issues/383 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde https://gitlab.com/libtiff/libtiff/-/issues/278 https://gitlab.com/libtiff/libtiff/-/merge_requests/311 https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64 https://security.archlinux.org/CVE-2022-0561 https://security.archlinux.org/CVE-2022-0562 https://security.archlinux.org/CVE-2022-0865 https://security.archlinux.org/CVE-2022-0891 https://security.archlinux.org/CVE-2022-0907 https://security.archlinux.org/CVE-2022-0908 https://security.archlinux.org/CVE-2022-0909 https://security.archlinux.org/CVE-2022-0924 https://security.archlinux.org/CVE-2022-22844

Severity
CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891
CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924
CVE-2022-22844
Package : libtiff
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2658

Impact

A remote attacker is able to crash the application or execute arbitrary code on the affected host via a crafted tiff file.

Workaround

None.

Related News

Test AD

319
© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.