tiff: CVE-2022-48281

Debian Bug report logs - #1029653
tiff: CVE-2022-48281

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tiff: CVE-2022-48281

Date: Wed, 25 Jan 2023 21:48:32 +0100

Source: tiff
Version: 4.5.0-3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.com/libtiff/libtiff/-/issues/488
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for tiff.

CVE-2022-48281[0]:
| processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has
| a heap-based buffer overflow (e.g., "WRITE of size 307203") via a
| crafted TIFF image.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-48281
    https://www.cve.org/CVERecord?id=CVE-2022-48281
[1] https://gitlab.com/libtiff/libtiff/-/issues/488
[2] https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1029653-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1029653-close@bugs.debian.org

Subject: Bug#1029653: fixed in tiff 4.5.0-4

Date: Thu, 26 Jan 2023 00:08:51 +0000

Source: tiff
Source-Version: 4.5.0-4
Done: Laszlo Boszormenyi (GCS) <gcs@debian.org>

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1029653@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 25 Jan 2023 18:28:55 +0100
Source: tiff
Architecture: source
Version: 4.5.0-4
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Closes: 1029653
Changes:
 tiff (4.5.0-4) unstable; urgency=high
 .
   * Backport security fix for CVE-2022-48281, heap-based buffer overflow in
     processCropSelections() (closes: #1029653).
Checksums-Sha1:
 ff94b788b2c732a78003f8ec505eb496843792c4 2255 tiff_4.5.0-4.dsc
 c9e7d2cb9056dfcc3633fd0f7fc9f778eff09764 22828 tiff_4.5.0-4.debian.tar.xz
Checksums-Sha256:
 35eaca1eab069814aa7b64e98f2428b436d3425d72ac798d0c889bbd88c97bc5 2255 tiff_4.5.0-4.dsc
 7d8458ee58d296f1f176c26debb053aeb26e0fd908933bf9bd0742ae25a458f5 22828 tiff_4.5.0-4.debian.tar.xz
Files:
 6d9cc63aaeb4febb816e508e8f836407 2255 libs optional tiff_4.5.0-4.dsc
 f76b368a9b80989db9dda3865c2dd616 22828 libs optional tiff_4.5.0-4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmPRtSMACgkQ3OMQ54ZM
yL94+hAAu2CJUr8JIkt1C9Ik83/92ySkwL/GhaIot3u8F1dlA9ygGtY8wUPtDMih
c1YRFtECxQOX5H1f/Ra96+hy7ZC8Mz+EJ1zMOI8gREpkJzFJnqZ6Zw24IatFnGws
uAkuTSdZImndtxULmt1M3Woi8YLMeDLGaOFPqiMnuWltFH+4cUPuprBf0k8kG1II
zoGyTu0P152OLbFxK/baYOJExkYZNzW8B/TERFWjHGcbALo8/WikuHoTTbLo9CnI
kEkqg0G9oPXjROJEEEBPsKG2CYml0oBaHKbn8ZRbJUJmxtn91Y+jQg4VHkMByDJ6
fmvXP3EGT7TKSK+sUjL1rXNpSYraNcI2NIWUKH+JPVE67OnjFcuyPpDe2iOY6sWW
JGbbEivoctTZL+/GtlYJR8Si0tTDC4jQsFFOaODIpLAarPZ5cL+Vfwla9UWdoI2o
CVbfBqU/GB5FkUz3N9D42BdpgynpLu1pOwrNJasu6gtHhLrOpvZ8L/X6Cy/xD/ee
c/uPwF3O998EIpA9M4IfGQNc9fD2FnP9ivenoxrcII5Zk1gkbDu06xaxJjmTOoUW
1fFLYm7P1s8hEpLhfPdtqpovr+wM8Qafec2/FMFQt+Pwla1mB3PIYpKC1z4s8KXb
KR1uyP7+JFU6WkX27eoEC8LLS9c4nHOx7iEQ/3SeC19Sgexw8uE=
=PQ3d
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.