Debian Tiff vulnerabilities

CVE-2022-34526 [MEDIUM] CVE-2022-34526: tiff - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4... A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. Scope: local bookworm: resolved (fixed in 4.4.0-4) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-4) sid: re

CVE-2022-2519 [MEDIUM] CVE-2022-2519: tiff - There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found i... There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved (fixed in 4.4.0-6) trixie: resolved (fixed in 4.4.0-6)

CVE-2022-2521 [MEDIUM] CVE-2022-2521: tiff - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation... It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Scope: local bookworm: resolved (fixed in 4.4.0-6) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-6) sid: resolved

CVE-2006-3463 [HIGH] CVE-2006-3463: tiff - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses... The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large td_nstrips value, which triggers an infinite loop. Scope: local bookworm: resolved (fixed in 3.8.2-6) bullseye: resolved (fixed in 3.8.2-6)

CVE-2022-3598 [MEDIUM] CVE-2022-3598: tiff - LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in... LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: re

CVE-2017-18013 [MEDIUM] CVE-2017-18013: tiff - In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPri... In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. Scope: local bookworm: resolved (fixed in 4.0.9-3) bullseye: resolved (fixed in 4.0.9-3) forky: resolved (fixed in 4.0.9-3) sid: resolved (fixed in 4.0.9-3) trixie: resolved (fixed in 4.0.9-3)

CVE-2015-8783 [MEDIUM] CVE-2015-8783: tiff - tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bound... tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. Scope: local bookworm: resolved (fixed in 4.0.6-1) bullseye: resolved (fixed in 4.0.6-1) forky: resolved (fixed in 4.0.6-1) sid: resolved (fixed in 4.0.6-1) trixie: resolved (fixed in 4.0.6-1)

CVE-2016-5317 [MEDIUM] CVE-2016-5317: tiff - Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDeco... Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file. Scope: local bookworm: resolved (fixed in 4.0.6-2) bullseye: resolved (fixed in 4.0.6-2) forky: resolved (fixed in 4.0.6-2) sid: resolve

CVE-2016-10095 [MEDIUM] CVE-2016-10095: tiff - Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTI... Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file. Scope: local bookworm: resolved (fixed in 4.0.8-2) bullseye: resolved (fi

CVE-2023-3316 [MEDIUM] CVE-2023-3316: tiff - A NULL pointer dereference in TIFFClose() is caused by a failure to open an outp... A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. Scope: local bookworm: resolved (fixed in 4.5.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u6) forky: resolved (fixed in 4.5.0-5) sid: resolved (fixed in 4.5.0-5) trixie: resolved (fixed

CVE-2022-1355 [MEDIUM] CVE-2022-1355: tiff - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function.... A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service. Scope: local bookworm: resolved (fixed in 4.3.0-8) bullseye: resolved (fixed in 4.2.

CVE-2015-8781 [MEDIUM] CVE-2015-8781: tiff - tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bound... tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. Scope: local bookworm: resolved (fixed in 4.0.6-1) bullseye: resolved (fixed in 4.0.6-1) forky: resolved (fixed in 4.0.6-1) sid: resolved (fixed in 4.0.6-1) tri

CVE-2013-4231 [MEDIUM] CVE-2013-4231: tiff - Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to caus... Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the

CVE-2017-7593 [MEDIUM] CVE-2017-7593: tiff - tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initial... tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image. Scope: local bookworm: resolved (fixed in 4.0.7-6) bullseye: resolved (fixed in 4.0.7-6) forky: resolved (fixed in 4.0.7-6) sid: resolved (fixed in 4.0.7-6) trixie: resolved (fi

CVE-2022-0865 [MEDIUM] CVE-2022-0865: tiff - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denia... Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045. Scope: local bookworm: resolved (fixed in 4.3.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u1) forky: resolved (fixed in 4.3.0-5) sid: resolved (fixed in 4.3.0-5)

CVE-2022-2058 [MEDIUM] CVE-2022-2058: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de... Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Scope: local bookworm: resolved (fixed in 4.4.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-3) sid: resolved (fixed in 4.4.0-

CVE-2022-2057 [MEDIUM] CVE-2022-2057: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de... Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Scope: local bookworm: resolved (fixed in 4.4.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-3) sid: resolved (fixed in 4.4.0-

CVE-2022-2056 [MEDIUM] CVE-2022-2056: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de... Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Scope: local bookworm: resolved (fixed in 4.4.0-3) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in 4.4.0-3) sid: resolved (fixed in 4.4.0-

CVE-2022-3599 [MEDIUM] CVE-2022-3599: tiff - LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.... LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. Scope: local bookworm: resolved (fixed in 4.4.0-5) bullseye: resolved (fixed in 4.2.0-1+deb11u3) forky: resolved (fixed in

CVE-2016-5321 [MEDIUM] CVE-2016-5321: tiff - The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cau... The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image. Scope: local bookworm: resolved (fixed in 4.0.6-2) bullseye: resolved (fixed in 4.0.6-2) forky: resolved (fixed in 4.0.6-2) sid: resolved (fixed in 4.0.6-2) trixie: resolved (fixed in 4.0.6-2)