RedHat: RHSA-2022-8194:01 Moderate: libtiff security update | Linux...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: libtiff security update
Advisory ID:       RHSA-2022:8194-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8194
Issue date:        2022-11-15
CVE Names:         CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 
                   CVE-2022-0891 CVE-2022-0908 CVE-2022-0909 
                   CVE-2022-0924 CVE-2022-1354 CVE-2022-1355 
                   CVE-2022-22844 
=====================================================================

1. Summary:

An update for libtiff is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

The libtiff packages contain a library of functions for manipulating Tagged
Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561)

* libtiff: Null source pointer lead to Denial of Service via crafted TIFF
file (CVE-2022-0562)

* libtiff: reachable assertion (CVE-2022-0865)

* libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924)

* libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355)

* libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c
(CVE-2022-22844)

* libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891)

* tiff: Null source pointer passed as an argument to memcpy in
TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908)

* tiff: Divide By Zero error in tiffcrop (CVE-2022-0909)

* libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c
(CVE-2022-1354)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this
update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2042603 - CVE-2022-22844 libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c
2054494 - CVE-2022-0561 libtiff: Denial of Service via crafted TIFF file
2054495 - CVE-2022-0562 libtiff: Null source pointer lead to Denial of Service via crafted TIFF file
2064145 - CVE-2022-0908 tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c
2064146 - CVE-2022-0909 tiff: Divide By Zero error in tiffcrop
2064148 - CVE-2022-0924 libtiff: Out-of-bounds Read error in tiffcp
2064406 - CVE-2022-0865 libtiff: reachable assertion
2064411 - CVE-2022-0891 libtiff: heap buffer overflow in extractImageSection
2074404 - CVE-2022-1354 libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c
2074415 - CVE-2022-1355 libtiff: stack-buffer-overflow in tiffcp.c in main()

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:
libtiff-4.4.0-2.el9.src.rpm

aarch64:
libtiff-4.4.0-2.el9.aarch64.rpm
libtiff-debuginfo-4.4.0-2.el9.aarch64.rpm
libtiff-debugsource-4.4.0-2.el9.aarch64.rpm
libtiff-devel-4.4.0-2.el9.aarch64.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.aarch64.rpm

ppc64le:
libtiff-4.4.0-2.el9.ppc64le.rpm
libtiff-debuginfo-4.4.0-2.el9.ppc64le.rpm
libtiff-debugsource-4.4.0-2.el9.ppc64le.rpm
libtiff-devel-4.4.0-2.el9.ppc64le.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.ppc64le.rpm

s390x:
libtiff-4.4.0-2.el9.s390x.rpm
libtiff-debuginfo-4.4.0-2.el9.s390x.rpm
libtiff-debugsource-4.4.0-2.el9.s390x.rpm
libtiff-devel-4.4.0-2.el9.s390x.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.s390x.rpm

x86_64:
libtiff-4.4.0-2.el9.i686.rpm
libtiff-4.4.0-2.el9.x86_64.rpm
libtiff-debuginfo-4.4.0-2.el9.i686.rpm
libtiff-debuginfo-4.4.0-2.el9.x86_64.rpm
libtiff-debugsource-4.4.0-2.el9.i686.rpm
libtiff-debugsource-4.4.0-2.el9.x86_64.rpm
libtiff-devel-4.4.0-2.el9.i686.rpm
libtiff-devel-4.4.0-2.el9.x86_64.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.i686.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 9):

aarch64:
libtiff-debuginfo-4.4.0-2.el9.aarch64.rpm
libtiff-debugsource-4.4.0-2.el9.aarch64.rpm
libtiff-tools-4.4.0-2.el9.aarch64.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.aarch64.rpm

ppc64le:
libtiff-debuginfo-4.4.0-2.el9.ppc64le.rpm
libtiff-debugsource-4.4.0-2.el9.ppc64le.rpm
libtiff-tools-4.4.0-2.el9.ppc64le.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.ppc64le.rpm

s390x:
libtiff-debuginfo-4.4.0-2.el9.s390x.rpm
libtiff-debugsource-4.4.0-2.el9.s390x.rpm
libtiff-tools-4.4.0-2.el9.s390x.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.s390x.rpm

x86_64:
libtiff-debuginfo-4.4.0-2.el9.x86_64.rpm
libtiff-debugsource-4.4.0-2.el9.x86_64.rpm
libtiff-tools-4.4.0-2.el9.x86_64.rpm
libtiff-tools-debuginfo-4.4.0-2.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-0561
https://access.redhat.com/security/cve/CVE-2022-0562
https://access.redhat.com/security/cve/CVE-2022-0865
https://access.redhat.com/security/cve/CVE-2022-0891
https://access.redhat.com/security/cve/CVE-2022-0908
https://access.redhat.com/security/cve/CVE-2022-0909
https://access.redhat.com/security/cve/CVE-2022-0924
https://access.redhat.com/security/cve/CVE-2022-1354
https://access.redhat.com/security/cve/CVE-2022-1355
https://access.redhat.com/security/cve/CVE-2022-22844
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY3PhGNzjgjWX9erEAQgQ5hAAp4Eqvm+2MVRXj33U0JsaiDpuTkz4E+X5
/FD8evDwgF4hPd32ThDus+s33/zk28BSrWzl51YSdLwGyJyMfnlzU7mH3m/Yo9lr
k1g1o5aZGI1c05G00q3bAgZqCtMd0vptcG/Lbhppx678rd/d5poyOs3alPNmziP8
ips9bLnjB+maz5UViNlf6b7F81vSFeci7KN88VtY2sclnxmitY9jkuopLe1pV4zE
+47qBz9JgFwXiuFVNHW46w1O9VZD3Oohr+85WySuDVXgu0tq22J1abA40F+rPSZD
ElDWvCrlL8H2K+sOsCgwwi+KJJLKI3Whle4YWyD5n6CMYTtn9P49tBvHKXFjRZSA
xhfq0B+7CNhdVUl5Q741YTHZ0rjnCqLG0k+HgT4fCL/n+fvSHVM7C5F0lYiSR+UE
mOFEOnjewTOpdxhxnCBI6i3vUAEe2SXU2zJIt/1Rj4R4FVHF1c6O0zNQOUIeoY0H
zrPAT7/WmV5Uw6zz8QH2PfHNLqO8/EKCZ58rGaSthlt9F47gccpc+xkQYLUwLw8C
9RNCsJME+OzkVLR31T29whOyzRXsH3d9gORJ2ALkUiM/dm3qQNRGac+Zw1+07x/Z
rC32VLGzeTyhBlH54CN4WxK9cC20Zi5mILNDx/5u8FEhdYDRoln7XraNmloG/bvf
3qRlpkTDGzk=
=ykHN
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-8194:01 Moderate: libtiff security update

An update for libtiff is now available for Red Hat Enterprise Linux 9

Summary

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561)
* libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562)
* libtiff: reachable assertion (CVE-2022-0865)
* libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924)
* libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355)
* libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844)
* libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891)
* tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908)
* tiff: Divide By Zero error in tiffcrop (CVE-2022-0909)
* libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258All running applications linked against libtiff must be restarted for thisupdate to take effect.

References

https://access.redhat.com/security/cve/CVE-2022-0561 https://access.redhat.com/security/cve/CVE-2022-0562 https://access.redhat.com/security/cve/CVE-2022-0865 https://access.redhat.com/security/cve/CVE-2022-0891 https://access.redhat.com/security/cve/CVE-2022-0908 https://access.redhat.com/security/cve/CVE-2022-0909 https://access.redhat.com/security/cve/CVE-2022-0924 https://access.redhat.com/security/cve/CVE-2022-1354 https://access.redhat.com/security/cve/CVE-2022-1355 https://access.redhat.com/security/cve/CVE-2022-22844 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: libtiff-4.4.0-2.el9.src.rpm
aarch64: libtiff-4.4.0-2.el9.aarch64.rpm libtiff-debuginfo-4.4.0-2.el9.aarch64.rpm libtiff-debugsource-4.4.0-2.el9.aarch64.rpm libtiff-devel-4.4.0-2.el9.aarch64.rpm libtiff-tools-debuginfo-4.4.0-2.el9.aarch64.rpm
ppc64le: libtiff-4.4.0-2.el9.ppc64le.rpm libtiff-debuginfo-4.4.0-2.el9.ppc64le.rpm libtiff-debugsource-4.4.0-2.el9.ppc64le.rpm libtiff-devel-4.4.0-2.el9.ppc64le.rpm libtiff-tools-debuginfo-4.4.0-2.el9.ppc64le.rpm
s390x: libtiff-4.4.0-2.el9.s390x.rpm libtiff-debuginfo-4.4.0-2.el9.s390x.rpm libtiff-debugsource-4.4.0-2.el9.s390x.rpm libtiff-devel-4.4.0-2.el9.s390x.rpm libtiff-tools-debuginfo-4.4.0-2.el9.s390x.rpm
x86_64: libtiff-4.4.0-2.el9.i686.rpm libtiff-4.4.0-2.el9.x86_64.rpm libtiff-debuginfo-4.4.0-2.el9.i686.rpm libtiff-debuginfo-4.4.0-2.el9.x86_64.rpm libtiff-debugsource-4.4.0-2.el9.i686.rpm libtiff-debugsource-4.4.0-2.el9.x86_64.rpm libtiff-devel-4.4.0-2.el9.i686.rpm libtiff-devel-4.4.0-2.el9.x86_64.rpm libtiff-tools-debuginfo-4.4.0-2.el9.i686.rpm libtiff-tools-debuginfo-4.4.0-2.el9.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 9):
aarch64: libtiff-debuginfo-4.4.0-2.el9.aarch64.rpm libtiff-debugsource-4.4.0-2.el9.aarch64.rpm libtiff-tools-4.4.0-2.el9.aarch64.rpm libtiff-tools-debuginfo-4.4.0-2.el9.aarch64.rpm
ppc64le: libtiff-debuginfo-4.4.0-2.el9.ppc64le.rpm libtiff-debugsource-4.4.0-2.el9.ppc64le.rpm libtiff-tools-4.4.0-2.el9.ppc64le.rpm libtiff-tools-debuginfo-4.4.0-2.el9.ppc64le.rpm
s390x: libtiff-debuginfo-4.4.0-2.el9.s390x.rpm libtiff-debugsource-4.4.0-2.el9.s390x.rpm libtiff-tools-4.4.0-2.el9.s390x.rpm libtiff-tools-debuginfo-4.4.0-2.el9.s390x.rpm
x86_64: libtiff-debuginfo-4.4.0-2.el9.x86_64.rpm libtiff-debugsource-4.4.0-2.el9.x86_64.rpm libtiff-tools-4.4.0-2.el9.x86_64.rpm libtiff-tools-debuginfo-4.4.0-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:8194-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8194
Issued Date: : 2022-11-15
CVE Names: CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-1354 CVE-2022-1355 CVE-2022-22844

Topic

An update for libtiff is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2042603 - CVE-2022-22844 libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c

2054494 - CVE-2022-0561 libtiff: Denial of Service via crafted TIFF file

2054495 - CVE-2022-0562 libtiff: Null source pointer lead to Denial of Service via crafted TIFF file

2064145 - CVE-2022-0908 tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c

2064146 - CVE-2022-0909 tiff: Divide By Zero error in tiffcrop

2064148 - CVE-2022-0924 libtiff: Out-of-bounds Read error in tiffcp

2064406 - CVE-2022-0865 libtiff: reachable assertion

2064411 - CVE-2022-0891 libtiff: heap buffer overflow in extractImageSection

2074404 - CVE-2022-1354 libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c

2074415 - CVE-2022-1355 libtiff: stack-buffer-overflow in tiffcp.c in main()

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.