FS#74772 - [libtiff] [security] CVE-2022-1354 CVE-2022-1355

Attached to Project: Arch Linux
Opened by T.J. Townsend (blakkheim) - Monday, 16 May 2022, 17:20 GMT
Last edited by Antonio Rojas (arojas) - Sunday, 19 June 2022, 09:28 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Levente Polyak (anthraxx)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
The libtiff package is vulnerable to CVE-2022-1354 and CVE-2022-1355. The attached diff adds these two fixes as well as two segmentation fault fixes that are required for the second CVE diff to apply cleanly.

Additional info:
One of the diffs modifies a binary file, so the patch command will refuse to apply it. As a workaround, use "git apply" to apply them. Feel free to do something else if you have a better idea.
   libtiff.diff (4.2 KiB)
This task depends upon

Closed by  Antonio Rojas (arojas)
Sunday, 19 June 2022, 09:28 GMT
Reason for closing:  Fixed
Comment by T.J. Townsend (blakkheim) - Monday, 23 May 2022, 16:33 GMT
There are more CVEs fixed that have been found since this patch was submitted.

4.4.0rc1 was released two days ago with all of the currently missing fixes.
Comment by T.J. Townsend (blakkheim) - Saturday, 28 May 2022, 14:35 GMT
The 4.4.0 release is out now. It looks like it includes shlib changes, so things depending on libtiff might need to be rebuilt too.
   libtiff.diff (3.9 KiB)

Loading...