Bug 31585 - libtiff new security issues CVE-2023-079[5-9] and CVE-2023-080[0-4]
Summary: libtiff new security issues CVE-2023-079[5-9] and CVE-2023-080[0-4]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-02-22 15:41 CET by David Walser
Modified: 2023-03-01 22:16 CET (History)
5 users (show)

See Also:
Source RPM: libtiff-4.2.0-1.13.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2023-02-22 15:41:06 CET
Debian-LTS has issued an advisory on February 21:
https://www.debian.org/lts/security/2023/dla-3333

Mageia 8 is also affected.
David Walser 2023-02-22 15:41:22 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Patches available from upstream and Debian

Comment 1 Lewis Smith 2023-02-22 20:28:06 CET
This is for you, Nicolas.

Assignee: bugsquad => nicolas.salguero

Comment 2 Nicolas Salguero 2023-02-27 12:00:56 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0795)

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0796)

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0797)

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0798)

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0799)

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0800)

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0801)

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0802)

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0803)

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. (CVE-2023-0804)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0795
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0796
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0797
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0798
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0799
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0801
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0802
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0803
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0804
https://www.debian.org/lts/security/2023/dla-3333
========================

Updated packages in core/updates_testing:
========================
lib(64)tiff5-4.2.0-1.14.mga8
lib(64)tiff-devel-4.2.0-1.14.mga8
lib(64)tiff-static-devel-4.2.0-1.14.mga8
libtiff-progs-4.2.0-1.14.mga8

from SRPM:
libtiff-4.2.0-1.14.mga8.src.rpm

Status: NEW => ASSIGNED
CC: (none) => nicolas.salguero
Status comment: Patches available from upstream and Debian => (none)
Version: Cauldron => 8
Assignee: nicolas.salguero => qa-bugs
Whiteboard: MGA8TOO => (none)
Source RPM: libtiff-4.5.0-4.mga9.src.rpm => libtiff-4.2.0-1.13.mga8.src.rpm

Comment 3 David Walser 2023-02-27 16:22:21 CET
Debian has issued an advisory for this on February 24:
https://www.debian.org/security/2023/dsa-5361
Comment 4 Herman Viaene 2023-02-27 17:02:55 CET
MGA8-64 MATE on Acer Aspire 5253
No installation issues
Followed bug 61467
$ tiff2pdf 1973-024.tif > 1973.pdf
Generated pdf displays the picture OK.
$ tiffinfo 1973-024.tif
TIFF Directory at offset 0x2e9da08 (48880136)
  Subfile Type: (0 = 0x0)
  Image Width: 2904 Image Length: 4208
  Resolution: 3200, 3200 pixels/inch
  Bits/Sample: 8
  Compression Scheme: None
  Photometric Interpretation: RGB color
  Extra Samples: 1<assoc-alpha>
  Orientation: row 0 top, col 0 lhs
  Samples/Pixel: 4
  Rows/Strip: 64
  Planar Configuration: single image plane
  DocumentName: /home/herman/HV/fotos/kleurnegatieven/1973/1973-024.tif
  ImageDescription: Created with GIMP

$ gimp 1973-024.tif 
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
Warning: Unknown input_id: -1 for input: surfacemap_x
bps: 8
Image dimensions: 2904 x 4208.
load_contiguous
bytes_per_pixel: 4, format: 4
Pïcture displays OK in gimp.
OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 5 Thomas Andrews 2023-03-01 17:29:01 CET
Validating. Advisory in comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2023-03-01 18:03:43 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 6 Mageia Robot 2023-03-01 22:16:08 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0080.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.