Debian Tiff vulnerabilities

CVE-2018-10779 [MEDIUM] CVE-2018-10779: tiff - TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-r... TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. Scope: local bookworm: resolved (fixed in 4.0.6-3) bullseye: resolved (fixed in 4.0.6-3) forky: resolved (fixed in 4.0.6-3) sid: resolved (fixed in 4.0.6-3) trixie: resolved (fixed in 4.0.6-3)

CVE-2018-5784 [MEDIUM] CVE-2018-5784: tiff - In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDi... In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. Scope: local bookworm: resolve

CVE-2018-18661 [MEDIUM] CVE-2018-18661: tiff - An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in... An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. Scope: local bookworm: resolved (fixed in 4.0.10-1) bullseye: resolved (fixed in 4.0.10-1) forky: resolved (fixed in 4.0.10-1) sid: resolved (fixed in 4.0.10-1) trixie: resolved (fixed in 4.0.10-1)

CVE-2017-11613 [MEDIUM] CVE-2017-11613: tiff - In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen fun... In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based

CVE-2014-9655 [MEDIUM] CVE-2014-9655: tiff - The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode fu... The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif. Scope: local bookworm: resolved (fixed in 4.0.3-12.1) bullseye: resolved (fixed in 4.0.3-1

CVE-2020-19144 [MEDIUM] CVE-2020-19144: tiff - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service... Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'. Scope: local bookworm: resolved (fixed in 4.0.10+git190814-1) bullseye: resolved (fixed in 4.0.10+git190814-1) forky: resolved (fixed in 4.0.10+git190814-1) sid: resolved (fixed in 4.0.10+git190814-1) trixie: resolved (fixed

CVE-2014-8130 [MEDIUM] CVE-2014-8130: tiff - The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero s... The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither. Scope: local bookworm: resolved (fixed in 4.0.5-1) bullse

CVE-2018-10963 [MEDIUM] CVE-2018-10963: tiff - The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 ... The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. Scope: local bookworm: resolved (fixed in 4.0.9-6) bullseye: resolved (fixed in 4.0.9-6) forky: resolved (fixed in 4.0.9-6) sid

CVE-2017-13726 [MEDIUM] CVE-2017-13726: tiff - There is a reachable assertion abort in the function TIFFWriteDirectorySec() in ... There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. Scope: local bookworm: resolved (fixed in 4.0.8-5) bullseye: resolved (fixed in 4.0.8-5) forky: resolved (fixed in 4.0.8-5) sid: resolved (fixed in 4.0.8-5) trixie: r

CVE-2017-13727 [MEDIUM] CVE-2017-13727: tiff - There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd... There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack. Scope: local bookworm: resolved (fixed in 4.0.8-5) bullseye: resolved (fixed in 4.0.8-5) forky: resolved (fixed in 4.0.8-5) sid: resolved (fixed in 4.0.8-5) tri

CVE-2016-5316 [MEDIUM] CVE-2016-5316: tiff - Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff ... Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool. Scope: local bookworm: resolved (fixed in 4.0.6-2) bullseye: resolved (fixed in 4.0.6-2) forky: resolved (fixed in 4.0.6-2) sid: resolved (fixed in 4.0.6-2) trixie: reso

CVE-2016-3625 [MEDIUM] CVE-2016-3625: tiff - tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attack... tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image. Scope: local bookworm: resolved (fixed in 4.0.3-1) bullseye: resolved (fixed in 4.0.3-1) forky: resolved (fixed in 4.0.3-1) sid: resolved (fixed in 4.0.3-1) trixie: resolved (fixed in 4.0.3-1)

CVE-2022-34526 [MEDIUM] CVE-2022-34526: tiff - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4... A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. Scope: local bookworm: resolved (fixed in 4.4.0-4) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-4) sid: re

CVE-2020-19143 [MEDIUM] CVE-2020-19143: tiff - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service... Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'. Scope: local bookworm: resolved (fixed in 4.1.0+git201212-1) bullseye: resolved (fixed in 4.1.0+git201212-1) forky: resolved (fixed in 4.1.0+git201212-1) sid: resolved (fixed in 4.1.0+git201212-1) trixie: resolved (fix

CVE-2022-2521 [MEDIUM] CVE-2022-2521: tiff - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation... It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved

CVE-2022-2520 [MEDIUM] CVE-2022-2520: tiff - A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rot... A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved (fixed in 4.4.0-6) trixie: resolved (fixed in 4.4.0-6)

CVE-2022-3627 [MEDIUM] CVE-2022-3627: tiff - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:34... LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolv

CVE-2022-3597 [MEDIUM] CVE-2022-3597: tiff - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:34... LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolv

CVE-2022-3626 [MEDIUM] CVE-2022-3626: tiff - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:34... LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: reso

CVE-2017-18013 [MEDIUM] CVE-2017-18013: tiff - In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPri... In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. Scope: local bookworm: resolved (fixed in 4.0.9-3) bullseye: resolved (fixed in 4.0.9-3) forky: resolved (fixed in 4.0.9-3) sid: resolved (fixed in 4.0.9-3) trixie: resolved (fixed in 4.0.9-3)