Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Debian: 2932-1 Moderate: TIFF Denial of Service and Memory Issues

debian lts
Calendar Grey March 6, 2022
Dist Debian Esm H88
Debian LTS Update addresses vulnerabilities in libgd that may permit Denial of Service through specially crafted images. Discover more.
Several issues have been found in tiff, a library and tools to manipulate and convert files in the Tag Image File Format (TIFF)
Topics%20covered

Topics Covered

security advisory Debian software fix security patch memory issue Denial of Service TIFF

Summary

CVE-2022-22844

out-of-bounds read in _TIFFmemcpy in certain situations involving a
custom tag and 0x0200 as the second word of the DE field.

CVE-2022-0562

Null source pointer passed as an argument to memcpy() function within
TIFFReadDirectory(). This could result in a Denial of Service via
crafted TIFF files.

CVE-2022-0561

Null source pointer passed as an argument to memcpy() function within
TIFFFetchStripThing(). This could result in a Denial of Service via
crafted TIFF files.


For Debian 9 stretch, these problems have been fixed in version
4.0.8-2+deb9u8.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/tiff

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Package: tiff
Version: 4.0.8-2+deb9u8
CVE ID: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844
Debian Bug:

Topics%20covered

Topics Covered

security advisory Debian software fix security patch memory issue Denial of Service TIFF

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here