- Arch-security - lists.archlinux.org

[ASA-202403-1] xz: arbitrary code execution
by Santiago Torres-Arias 29 Mar '24

29 Mar '24

Arch Linux Security Advisory ASA-202403-1 ========================================= Severity: Critical Date : 2024-03-29 CVE-ID : CVE-2024-3094 Package : xz Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2851 Summary ======= The package xz before version 5.6.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.6.1-2. # pacman -Syu "xz>=5.6.1-2" The problem has been fixed upstream in version 5.6.1. Workaround ========== None. Description =========== Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions. Impact ====== The malicious code path does not exist in the arch version of sshd, as it does not link to liblzma. However, out of an abundance of caution, we advise users to avoid the vulnerable code in their system as it is possible it could be triggered from other, un-identified vectors. References ========== https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-… https://security.archlinux.org/CVE-2024-3094

1 0

ClamAV outdated and susceptible to DOS attack
by Dirk Räder 21 Aug '23

21 Aug '23

Hi, I'm not sure whether this is right mailing list. If not, please point me to the right one. ClamAV has released patched versions 1.1.1 and 1.0.2 almost a week ago deploying critical patches. Both address CVE-2023-20197 which has a CVSS 3.x score of 7.5. The latter also tackles CVE-2023-20212, also having CVSS 3.x score of 7.5. Seeing that ClamAV has been flagged out-of-date in the package repo on 2023-05-02, I'm wondering when this will be updated - or if there's anything I could do to update the ClamAV package myself. Kind regards, Dirk Räder dirk(a)raeder.cc

1 0

[ASA-202210-4] linux-zen: multiple issues
by Levente Polyak 15 Oct '22

15 Oct '22

Arch Linux Security Advisory ASA-202210-4 ========================================= Severity: Critical Date : 2022-10-14 CVE-ID : CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 Package : linux-zen Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2803 Summary ======= The package linux-zen before version 6.0.1.zen2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 6.0.1.zen2-1. # pacman -Syu "linux-zen>=6.0.1.zen2-1" The problems have been fixed upstream in version 6.0.1.zen2. Workaround ========== None. Description =========== - CVE-2022-41674 (information disclosure) A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_nontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows a remote attacker to inject WLAN frames to crash the system or leak internal kernel information. - CVE-2022-42719 (arbitrary code execution) A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to crash the kernel and potentially execute code. - CVE-2022-42720 (arbitrary code execution) Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to trigger use-after-free conditions to potentially execute code. - CVE-2022-42721 (arbitrary code execution) A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code. - CVE-2022-42722 (denial of service) In the Linux kernel 5.8 through 5.19.14, remote attackers are able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Impact ====== A remote attacker is able to inject WLAN frames to crash the system or execute arbitrary code on the affected host. References ========== https://www.openwall.com/lists/oss-security/2022/10/13/2 https://lore.kernel.org/netdev/20221013100522.46346-1-johannes@sipsolutions… https://www.openwall.com/lists/oss-security/2022/10/13/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1203770 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204051 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204059 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204060 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204125 https://security.archlinux.org/CVE-2022-41674 https://security.archlinux.org/CVE-2022-42719 https://security.archlinux.org/CVE-2022-42720 https://security.archlinux.org/CVE-2022-42721 https://security.archlinux.org/CVE-2022-42722

1 0

[ASA-202210-3] linux-lts: multiple issues
by Levente Polyak 15 Oct '22

15 Oct '22

Arch Linux Security Advisory ASA-202210-3 ========================================= Severity: Critical Date : 2022-10-14 CVE-ID : CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 Package : linux-lts Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2802 Summary ======= The package linux-lts before version 5.15.73-3 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 5.15.73-3. # pacman -Syu "linux-lts>=5.15.73-3" The problems have been fixed upstream in version 5.15.73. Workaround ========== None. Description =========== - CVE-2022-41674 (information disclosure) A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_nontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows a remote attacker to inject WLAN frames to crash the system or leak internal kernel information. - CVE-2022-42719 (arbitrary code execution) A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to crash the kernel and potentially execute code. - CVE-2022-42720 (arbitrary code execution) Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to trigger use-after-free conditions to potentially execute code. - CVE-2022-42721 (arbitrary code execution) A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code. - CVE-2022-42722 (denial of service) In the Linux kernel 5.8 through 5.19.14, remote attackers are able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Impact ====== A remote attacker is able to inject WLAN frames to crash the system or execute arbitrary code on the affected host. References ========== https://www.openwall.com/lists/oss-security/2022/10/13/2 https://lore.kernel.org/netdev/20221013100522.46346-1-johannes@sipsolutions… https://www.openwall.com/lists/oss-security/2022/10/13/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1203770 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204051 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204059 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204060 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204125 https://security.archlinux.org/CVE-2022-41674 https://security.archlinux.org/CVE-2022-42719 https://security.archlinux.org/CVE-2022-42720 https://security.archlinux.org/CVE-2022-42721 https://security.archlinux.org/CVE-2022-42722

1 0

[ASA-202210-2] linux: multiple issues
by Levente Polyak 15 Oct '22

15 Oct '22

Arch Linux Security Advisory ASA-202210-2 ========================================= Severity: Critical Date : 2022-10-14 CVE-ID : CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 Package : linux Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2801 Summary ======= The package linux before version 6.0.1.arch2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 6.0.1.arch2-1. # pacman -Syu "linux>=6.0.1.arch2-1" The problems have been fixed upstream in version 6.0.1.arch2. Workaround ========== None. Description =========== - CVE-2022-41674 (information disclosure) A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_nontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows a remote attacker to inject WLAN frames to crash the system or leak internal kernel information. - CVE-2022-42719 (arbitrary code execution) A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to crash the kernel and potentially execute code. - CVE-2022-42720 (arbitrary code execution) Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to trigger use-after-free conditions to potentially execute code. - CVE-2022-42721 (arbitrary code execution) A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code. - CVE-2022-42722 (denial of service) In the Linux kernel 5.8 through 5.19.14, remote attackers are able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Impact ====== A remote attacker is able to inject WLAN frames to crash the system or execute arbitrary code on the affected host. References ========== https://www.openwall.com/lists/oss-security/2022/10/13/2 https://lore.kernel.org/netdev/20221013100522.46346-1-johannes@sipsolutions… https://www.openwall.com/lists/oss-security/2022/10/13/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1203770 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204051 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204059 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204060 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204125 https://security.archlinux.org/CVE-2022-41674 https://security.archlinux.org/CVE-2022-42719 https://security.archlinux.org/CVE-2022-42720 https://security.archlinux.org/CVE-2022-42721 https://security.archlinux.org/CVE-2022-42722

1 0

[ASA-202210-1] linux-hardened: multiple issues
by Levente Polyak 15 Oct '22

15 Oct '22

Arch Linux Security Advisory ASA-202210-1 ========================================= Severity: Critical Date : 2022-10-14 CVE-ID : CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 Package : linux-hardened Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2800 Summary ======= The package linux-hardened before version 5.19.15.hardened2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 5.19.15.hardened2-1. # pacman -Syu "linux-hardened>=5.19.15.hardened2-1" The problems have been fixed upstream in version 5.19.15.hardened2. Workaround ========== None. Description =========== - CVE-2022-41674 (information disclosure) A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_nontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows a remote attacker to inject WLAN frames to crash the system or leak internal kernel information. - CVE-2022-42719 (arbitrary code execution) A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to crash the kernel and potentially execute code. - CVE-2022-42720 (arbitrary code execution) Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to trigger use-after-free conditions to potentially execute code. - CVE-2022-42721 (arbitrary code execution) A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code. - CVE-2022-42722 (denial of service) In the Linux kernel 5.8 through 5.19.14, remote attackers are able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Impact ====== A remote attacker is able to inject WLAN frames to crash the system or execute arbitrary code on the affected host. References ========== https://www.openwall.com/lists/oss-security/2022/10/13/2 https://www.openwall.com/lists/oss-security/2022/10/13/5 https://lore.kernel.org/netdev/20221013100522.46346-1-johannes@sipsolutions… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1203770 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204051 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204059 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204060 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://bugzilla.suse.com/show_bug.cgi?id=1204125 https://security.archlinux.org/CVE-2022-41674 https://security.archlinux.org/CVE-2022-42719 https://security.archlinux.org/CVE-2022-42720 https://security.archlinux.org/CVE-2022-42721 https://security.archlinux.org/CVE-2022-42722

1 0

[ASA-202204-9] python-django: sql injection
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-9 ========================================= Severity: High Date : 2022-04-12 CVE-ID : CVE-2022-28346 CVE-2022-28347 Package : python-django Type : sql injection Remote : Yes Link : https://security.archlinux.org/AVG-2667 Summary ======= The package python-django before version 4.0.4-1 is vulnerable to sql injection. Resolution ========== Upgrade to 4.0.4-1. # pacman -Syu "python-django>=4.0.4-1" The problems have been fixed upstream in version 4.0.4. Workaround ========== None. Description =========== - CVE-2022-28346 (sql injection) QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods. - CVE-2022-28347 (sql injection) QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument. Impact ====== An attacker is able to perform an SQL injection via a specially crafted input. References ========== https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef080… https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7e… https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5… https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e… https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1b… https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408… https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf1887… https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa… https://security.archlinux.org/CVE-2022-28346 https://security.archlinux.org/CVE-2022-28347

1 0

[ASA-202204-8] xz: arbitrary command execution
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-8 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : xz Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2665 Summary ======= The package xz before version 5.2.5-3 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 5.2.5-3. # pacman -Syu "xz>=5.2.5-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ====== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========== https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148… https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f… https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

1 0

[ASA-202204-7] gzip: arbitrary command execution
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-7 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : gzip Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2666 Summary ======= The package gzip before version 1.12-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.12-1. # pacman -Syu "gzip>=1.12-1" The problem has been fixed upstream in version 1.12. Workaround ========== None. Description =========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ====== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========== https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148… https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f… https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

1 0

[ASA-202204-6] libtiff: multiple issues
by Levente Polyak 07 Apr '22

07 Apr '22

Arch Linux Security Advisory ASA-202204-6 ========================================= Severity: High Date : 2022-04-05 CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891 CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-22844 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2658 Summary ======= The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.3.0-2. # pacman -Syu "libtiff>=4.3.0-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2022-0561 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0562 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0865 (denial of service) Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0891 (arbitrary code execution) A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact. - CVE-2022-0907 (denial of service) Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0908 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0909 (denial of service) A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0924 (denial of service) Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-22844 (denial of service) LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host via a crafted tiff file. References ========== https://bugs.archlinux.org/task/74229 https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a… https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7d… https://gitlab.com/libtiff/libtiff/-/issues/385 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa5… https://gitlab.com/libtiff/libtiff/-/issues/380 https://gitlab.com/libtiff/libtiff/-/issues/382 https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb… https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac… https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f8… https://gitlab.com/libtiff/libtiff/-/issues/383 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb… https://gitlab.com/libtiff/libtiff/-/issues/278 https://gitlab.com/libtiff/libtiff/-/merge_requests/311 https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f… https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e… https://security.archlinux.org/CVE-2022-0561 https://security.archlinux.org/CVE-2022-0562 https://security.archlinux.org/CVE-2022-0865 https://security.archlinux.org/CVE-2022-0891 https://security.archlinux.org/CVE-2022-0907 https://security.archlinux.org/CVE-2022-0908 https://security.archlinux.org/CVE-2022-0909 https://security.archlinux.org/CVE-2022-0924 https://security.archlinux.org/CVE-2022-22844

1 0