Bug 30210 - libtiff new security issues CVE-2022-0865, CVE-2022-0891, CVE-2022-090[89], CVE-2022-0924
Summary: libtiff new security issues CVE-2022-0865, CVE-2022-0891, CVE-2022-090[89], C...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
: 30440 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-03-26 17:11 CET by David Walser
Modified: 2022-05-17 13:03 CEST (History)
4 users (show)

See Also:
Source RPM: libtiff-4.2.0-1.2.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2022-03-26 17:11:00 CET
Debian has issued an advisory on March 24:
https://www.debian.org/security/2022/dsa-5108

Mageia 8 is also affected.
David Walser 2022-03-26 17:11:21 CET

Status comment: (none) => Patches available from upstream and Debian
Whiteboard: (none) => MGA8TOO

Comment 1 Nicolas Salguero 2022-03-26 22:03:42 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVE-2022-0865)

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact. (CVE-2022-0891)

Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. (CVE-2022-0908)

Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVE-2022-0909)

Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVE-2022-0924)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0865
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0891
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0908
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0909
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0924
https://www.debian.org/security/2022/dsa-5108
========================

Updated packages in core/updates_testing:
========================
lib(64)tiff5-4.2.0-1.3.mga8
lib(64)tiff-devel-4.2.0-1.3.mga8
lib(64)tiff-static-devel-4.2.0-1.3.mga8
libtiff-progs-4.2.0-1.3.mga8

from SRPM:
libtiff-4.2.0-1.3.mga8.src.rpm

Whiteboard: MGA8TOO => (none)
Assignee: nicolas.salguero => qa-bugs
Version: Cauldron => 8
CC: (none) => nicolas.salguero
Status comment: Patches available from upstream and Debian => (none)
Status: NEW => ASSIGNED

Nicolas Salguero 2022-03-26 22:04:01 CET

Source RPM: libtiff-4.3.0-3.mga9.src.rpm => libtiff-4.2.0-1.2.mga8.src.rpm

Comment 2 Thomas Andrews 2022-03-27 16:48:01 CEST
i5-2500, Intel graphics, MGA8-64 Plasma system.

No installation issues. It just so happens that I just finished testing a graphicsmagick update, and urpmq indicates that uses lib64tiff5, so I used some of the commands found on https://wiki.mageia.org/en/QA_procedure:GraphicsMagick to test this.

I was able to convert a jpg image to tiff, though it complained about a "tag" being illegal for the codec. (normal. that happened with another image when testing graphicsmagick with the old lib64tiff5) I was able to display the image, flip it, and convert it to a png. All looks OK.

Validating. Advisory in Comment 1.

CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK
Keywords: (none) => validated_update

Dave Hodgins 2022-03-28 16:00:30 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 3 Mageia Robot 2022-03-28 18:24:43 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0119.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED

Comment 4 David Walser 2022-05-17 13:03:29 CEST
This update also fixed CVE-2022-1056, according to:
https://bugs.mageia.org/show_bug.cgi?id=30440#c1
Comment 5 David Walser 2022-05-17 13:03:41 CEST
*** Bug 30440 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.