FS#75360 - [security] [libtiff] CVE-2022-2056 / CVE-2022-2057 / CVE-2022-2058

Attached to Project: Arch Linux
Opened by T.J. Townsend (blakkheim) - Sunday, 17 July 2022, 22:29 GMT
Last edited by David Runge (dvzrv) - Monday, 01 August 2022, 08:39 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To David Runge (dvzrv)
Levente Polyak (anthraxx)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
The libtiff package is vulnerable to CVE-2022-2056, CVE-2022-2057, and CVE-2022-2058.

The attached diff applies an upstream commit to fix them.
   tiff.diff (1.4 KiB)
This task depends upon

Closed by  David Runge (dvzrv)
Monday, 01 August 2022, 08:39 GMT
Reason for closing:  Fixed
Additional comments about closing:  Fixed with libtiff 4.4.0-2 / lib32-libtiff 4.4.0-2
Comment by David Runge (dvzrv) - Friday, 29 July 2022, 12:24 GMT
@mysta: Thanks for the report!

Upstream fixes are applied in 4.4.0-2 in [testing] and [community-testing]. Feedback is much appreciated! :)
Comment by T.J. Townsend (blakkheim) - Friday, 29 July 2022, 14:28 GMT
I've been running with it for the last two weeks without any noticable breakage.
Comment by William Tang (william0419) - Sunday, 31 July 2022, 01:15 GMT
@dvzrv

Could you possibly add the symbol versioning support as well (https://bugs.archlinux.org/task/71330?project=1&string=libtiff)?

Thanks

Loading...