Security update for tiff SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0060-1 Final 1 1 2023-01-10T11:35:27Z current 2023-01-10T11:35:27Z 2023-01-10T11:35:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: - CVE-2022-3570: Fixed a potential crash in the tiffcrop utility (bsc#1205422). - CVE-2022-3598: Fixed a potential crash in the tiffcrop utility (bsc#1204642). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-SAP-BYOS-2023-60,Image SLES12-SP5-Azure-SAP-On-Demand-2023-60,Image SLES12-SP5-EC2-SAP-BYOS-2023-60,Image SLES12-SP5-EC2-SAP-On-Demand-2023-60,Image SLES12-SP5-GCE-SAP-BYOS-2023-60,Image SLES12-SP5-GCE-SAP-On-Demand-2023-60,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2023-60,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2023-60,SUSE-2023-60,SUSE-SLE-SDK-12-SP5-2023-60,SUSE-SLE-SERVER-12-SP5-2023-60 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/ Link for SUSE-SU-2023:0060-1 https://lists.suse.com/pipermail/sle-security-updates/2023-January/013447.html E-Mail link for SUSE-SU-2023:0060-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1204642 SUSE Bug 1204642 https://bugzilla.suse.com/1205422 SUSE Bug 1205422 https://www.suse.com/security/cve/CVE-2022-3570/ SUSE CVE CVE-2022-3570 page https://www.suse.com/security/cve/CVE-2022-3598/ SUSE CVE CVE-2022-3598 page Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libtiff5-4.0.9-44.62.1 libtiff-devel-4.0.9-44.62.1 libtiff-devel-32bit-4.0.9-44.62.1 libtiff-devel-64bit-4.0.9-44.62.1 libtiff5-32bit-4.0.9-44.62.1 libtiff5-64bit-4.0.9-44.62.1 tiff-4.0.9-44.62.1 libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libtiff5-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5 libtiff5-32bit-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5 tiff-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5 libtiff5-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtiff5-32bit-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 tiff-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtiff-devel-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact CVE-2022-3570 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.62.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.62.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/ https://www.suse.com/security/cve/CVE-2022-3570.html CVE-2022-3570 https://bugzilla.suse.com/1205422 SUSE Bug 1205422 LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. CVE-2022-3598 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.62.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.62.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.62.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/ https://www.suse.com/security/cve/CVE-2022-3598.html CVE-2022-3598 https://bugzilla.suse.com/1204642 SUSE Bug 1204642 https://bugzilla.suse.com/1206220 SUSE Bug 1206220