Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#74772 - [libtiff] [security] CVE-2022-1354 CVE-2022-1355

Attached to Project: Arch Linux
Opened by mysta (mysta) - Monday, 16 May 2022, 17:20 GMT
Last edited by Antonio Rojas (arojas) - Sunday, 19 June 2022, 09:28 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Levente Polyak (anthraxx)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
The libtiff package is vulnerable to CVE-2022-1354 and CVE-2022-1355. The attached diff adds these two fixes as well as two segmentation fault fixes that are required for the second CVE diff to apply cleanly.

Additional info:
One of the diffs modifies a binary file, so the patch command will refuse to apply it. As a workaround, use "git apply" to apply them. Feel free to do something else if you have a better idea.
This task depends upon

Closed by  Antonio Rojas (arojas)
Sunday, 19 June 2022, 09:28 GMT
Reason for closing:  Fixed
Comment by mysta (mysta) - Monday, 23 May 2022, 16:33 GMT
There are more CVEs fixed that have been found since this patch was submitted.

4.4.0rc1 was released two days ago with all of the currently missing fixes.
Comment by mysta (mysta) - Saturday, 28 May 2022, 14:35 GMT
The 4.4.0 release is out now. It looks like it includes shlib changes, so things depending on libtiff might need to be rebuilt too.

Loading...