Debian Tiff vulnerabilities

CVE-2022-2867 [MEDIUM] CVE-2022-2867: tiff - libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of boun... libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. Scope: local bookworm: resolved (fixed in 4.4.0~rc1-1) bullseye: resolved (fixed in 4

CVE-2022-3598 [MEDIUM] CVE-2022-3598: tiff - LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in... LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: re

CVE-2022-1354 [MEDIUM] CVE-2022-1354: tiff - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawData... A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. Scope: local bookworm: resolved (fixed in 4.3.0-7) bullseye: resolved (fixed in 4.2.0-1+deb11u3)

CVE-2022-2056 [MEDIUM] CVE-2022-2056: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de... Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Scope: local bookworm: resolved (fixed in 4.4.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-3) sid: resolved (fixed in 4.4.0-

CVE-2022-0865 [MEDIUM] CVE-2022-0865: tiff - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denia... Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045. Scope: local bookworm: resolved (fixed in 4.3.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u1) forky: resolved (fixed in 4.3.0-5) sid: resolved (fixed in 4.3.0-5)

CVE-2022-48281 [MEDIUM] CVE-2022-48281: tiff - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-ba... processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. Scope: local bookworm: resolved (fixed in 4.5.0-4) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.5.0-4) sid: resolved (fixed in 4.5.0-4) trixie: resolved (fixed in 4.5.0-4)

CVE-2022-0561 [MEDIUM] CVE-2022-0561: tiff - Null source pointer passed as an argument to memcpy() function within TIFFFetchS... Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Scope: local bookworm: resolved (fixed in 4.3.0-4) bullseye: resolved (fixed in

CVE-2022-0562 [MEDIUM] CVE-2022-0562: tiff - Null source pointer passed as an argument to memcpy() function within TIFFReadDi... Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. Scope: local bookworm: resolved (fixed in 4.3.0-4) bullseye: resolved (fixed in 4.2.0-

CVE-2022-3970 [MEDIUM] CVE-2022-3970: tiff - A vulnerability was found in LibTIFF. It has been classified as critical. This a... A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617

CVE-2022-2869 [MEDIUM] CVE-2022-2869: tiff - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds re... libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. Scope

CVE-2022-1622 [MEDIUM] CVE-2022-1622: tiff - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.... LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. Scope: local bookworm: resolved (fixed in 4.4.0~rc1-1) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed

CVE-2022-3597 [MEDIUM] CVE-2022-3597: tiff - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:34... LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolv

CVE-2022-2868 [MEDIUM] CVE-2022-2868: tiff - libtiff's tiffcrop utility has a improper input validation flaw that can lead to... libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. Scope: local bookworm: resolved (fixed in 4.4.0~rc1-1) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0~rc1-1) sid: resolved (fixed in 4.4.0~rc1-1) trix

CVE-2022-2058 [MEDIUM] CVE-2022-2058: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de... Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Scope: local bookworm: resolved (fixed in 4.4.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-3) sid: resolved (fixed in 4.4.0-

CVE-2022-1210 [MEDIUM] CVE-2022-1210: tiff - A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected b... A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. Scope: local bookworm: open bullseye: open forky:

CVE-2022-2519 [MEDIUM] CVE-2022-2519: tiff - There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found i... There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved (fixed in 4.4.0-6) trixie: resolved (fixed in 4.4.0-6)

CVE-2022-1056 [MEDIUM] CVE-2022-1056: tiff - Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause ... Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. Scope: local bookworm: resolved (fixed in 4.4.0~rc1-1) bullseye: open forky: resolved (fixed in 4.4.0~rc1-1) sid: resolved (fixed in 4.4.0~rc1-1) trixie: reso

CVE-2022-2953 [MEDIUM] CVE-2022-2953: tiff - LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop... LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed i

CVE-2022-2520 [MEDIUM] CVE-2022-2520: tiff - A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rot... A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved (fixed in 4.4.0-6) trixie: resolved (fixed in 4.4.0-6)

CVE-2022-2521 [MEDIUM] CVE-2022-2521: tiff - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation... It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved