Debian Tiff vulnerabilities

CVE-2010-2443 [MEDIUM] CVE-2010-2443: tiff - The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows r... The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function. Scope: local bookworm: resolved (fixed in 3.9.4-1) bullseye: resolved (fixed in 3.9.4-1) forky: resolved (fix

CVE-2022-0908 [HIGH] CVE-2022-0908: tiff - Null source pointer passed as an argument to memcpy() function within TIFFFetchN... Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. Scope: local bookworm: resolved (fixed in 4.3.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u1) forky: resolved (fixed in 4.3.0-6) sid: resolved (fixed in 4.3.0-6) trixie: reso

CVE-2023-30774 [MEDIUM] CVE-2023-30774: tiff - A vulnerability was found in the libtiff library. This flaw causes a heap buffer... A vulnerability was found in the libtiff library. This flaw causes a heap buffer overflow issue via the TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS values. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-5) sid: resolved (fixed in 4.4.0-5) trixie: resolved (fixed in 4.4.0-5)

CVE-2023-25433 [MEDIUM] CVE-2023-25433: tiff - libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:849... libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. Scope: local bookworm: resolved (fixed in 4.5.0-6+deb12u2) bullseye: resolved (fixed in 4.2.0-1+deb11u6) forky: resolved (fixed in 4.5.1~rc3-1) sid: resolved (fixed in 4.5.1~rc3-1) tr

CVE-2022-2869 [MEDIUM] CVE-2022-2869: tiff - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds re... libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. Scope

CVE-2023-0801 [MEDIUM] CVE-2023-0801: tiff - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, ... LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Scope: local bookworm: resolved (fixed in 4.5.0-5) bullseye: resolved

CVE-2017-7594 [MEDIUM] CVE-2017-7594: tiff - The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7... The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6) sid: resolved (fixed in 4.0.7-6) trixie: resolved (fixed in 4.0.7-6)

CVE-2015-7313 [MEDIUM] CVE-2015-7313: tiff - LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memor... LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. Scope: local bookworm: resolved (fixed in 4.0.7-1) bullseye: resolved (fixed in 4.0.7-1) forky: resolved (fixed in 4.0.7-1) sid: resolved (fixed in 4.0.7-1) trixie: resolved (fixed in 4.0.7-1)

CVE-2022-22844 [MEDIUM] CVE-2022-22844: tiff - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain ... LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Scope: local bookworm: resolved (fixed in 4.3.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u1) forky: resolved (fixed in 4.3.0-3) sid: resolved (fixed in 4.3.0-3) trixie: resolved (fixed in 4.3.0-3)

CVE-2022-0561 [MEDIUM] CVE-2022-0561: tiff - Null source pointer passed as an argument to memcpy() function within TIFFFetchS... Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Scope: local bookworm: resolved (fixed in 4.3.0-4) bullseye: resolved (fixed in

CVE-2022-0562 [MEDIUM] CVE-2022-0562: tiff - Null source pointer passed as an argument to memcpy() function within TIFFReadDi... Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. Scope: local bookworm: resolved (fixed in 4.3.0-4) bullseye: resolved (fixed in 4.2.0-

CVE-2020-35521 [MEDIUM] CVE-2020-35521: tiff - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a... A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service. Scope: local bookworm: resolved (fixed in 4.1.0+git201212-1) bullseye: resolved (fixed in 4.1.0+git201212-1) forky: resolved (fixed in 4.1.0+git201212-1) sid: resolved (fixed in 4.1.0+git201212-1) trixie: resolved (f

CVE-2022-1354 [MEDIUM] CVE-2022-1354: tiff - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawData... A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. Scope: local bookworm: resolved (fixed in 4.3.0-7) bullseye: resolved (fixed in 4.2.0-1+deb11u3)

CVE-2023-26966 [MEDIUM] CVE-2023-26966: tiff - libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads... libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. Scope: local bookworm: resolved (fixed in 4.5.0-6+deb12u2) bullseye: resolved (fixed in 4.2.0-1+deb11u6) forky: resolved (fixed in 4.5.1~rc3-1) sid: resolved (fixed in 4.5.1~rc3-1) trixie: resolved (fixed in 4

CVE-2023-25435 [MEDIUM] CVE-2023-25435: tiff - libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8b... libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. Scope: local bookworm: resolved (fixed in 4.5.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u4) forky: resolved (fixed in 4.5.0-5) sid: resolved (fixed in 4.5.0-5) trixie: resolved (fixed in 4.5.0-5)

CVE-2022-2868 [MEDIUM] CVE-2022-2868: tiff - libtiff's tiffcrop utility has a improper input validation flaw that can lead to... libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. Scope: local bookworm: resolved (fixed in 4.4.0~rc1-1) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0~rc1-1) sid: resolved (fixed in 4.4.0~rc1-1) trix

CVE-2023-30775 [MEDIUM] CVE-2023-30775: tiff - A vulnerability was found in the libtiff library. This security flaw causes a he... A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c. Scope: local bookworm: resolved (fixed in 4.5.0-2) bullseye: open forky: resolved (fixed in 4.5.0-2) sid: resolved (fixed in 4.5.0-2) trixie: resolved (fixed in 4.5.0-2)

CVE-2022-3570 [HIGH] CVE-2022-3570: tiff - Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version ... Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolved (fixed in

CVE-2010-2598 [MEDIUM] CVE-2010-2598: tiff - LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tif... LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input." Scope: local bookworm: resolved (fixed in 3.9.4-1) bullseye:

CVE-2004-0886 [MEDIUM] CVE-2004-0886: tiff - Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers t... Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls. Scope: local bookworm: resolved (fixed in 3.6.1-2) bullseye: resolved (fixed in 3.6.1-2) forky: resolved (fixed in 3.6.1-2) sid: resolved (fixed in 3.6.1-2) trixie: resolved (fixed