Ubuntu 22.10: 5714-1 Moderate: LibTIFF Information Disclosure

ubuntu

November 8, 2022

Several security issues were fixed in LibTIFF.

Summary

Several security issues were fixed in LibTIFF.

Software Description:

- tiff: Tag Image File Format (TIFF) library

Details:

It was discovered that LibTIFF incorrectly handled certain memory operations

when using tiffcrop. An attacker could trick a user into processing a specially

crafted tiff image file and potentially use this issue to cause a denial of

service. This issue only affected Ubuntu 22.10. (CVE-2022-2519, CVE-2022-2520,

CVE-2022-2521, CVE-2022-2953)

It was discovered that LibTIFF did not properly perform bounds checking in

certain operations when using tiffcrop. An attacker could trick a user into

processing a specially crafted tiff image file and potentially use this issue

to allow for information disclosure or to cause the application to crash. This

issue only affected to Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.

(CVE-2022-2867, CVE-2022-2868, CVE-2022-2869)

It was discovered that LibTIFF did not properly perform bounds checking...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service Ubuntu information disclosure libtiff

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
  libtiff-tools                   4.4.0-4ubuntu3.1

Ubuntu 22.04 LTS:
  libtiff-tools                   4.3.0-6ubuntu0.2

Ubuntu 20.04 LTS:
  libtiff-tools                   4.1.0+git191117-2ubuntu0.20.04.6

Ubuntu 18.04 LTS:
  libtiff-tools                   4.0.9-5ubuntu0.8

Ubuntu 16.04 ESM:
  libtiff-tools                   4.0.6-1ubuntu0.8+esm7

Ubuntu 14.04 ESM:
  libtiff-tools                   4.0.3-7ubuntu0.11+esm5

In general, a standard system update will make all the necessary changes.