[ASA-202204-6] libtiff: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-202204-6
=========================================

Severity: High
Date    : 2022-04-05
CVE-ID  : CVE-2022-0561  CVE-2022-0562 CVE-2022-0865 CVE-2022-0891
           CVE-2022-0907  CVE-2022-0908 CVE-2022-0909 CVE-2022-0924
           CVE-2022-22844
Package : libtiff
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2658

Summary
=======

The package libtiff before version 4.3.0-2 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
==========

Upgrade to 4.3.0-2.

# pacman -Syu "libtiff>=4.3.0-2"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

- CVE-2022-0561 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0
to 4.3.0 could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0562 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to
4.3.0 could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0865 (denial of service)

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.

- CVE-2022-0891 (arbitrary code execution)

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in
libtiff library Version 4.3.0 allows attacker to trigger unsafe or out
of bounds memory access via crafted TIFF image file which could result
into application crash, potential information disclosure or any other
context-dependent impact.

- CVE-2022-0907 (denial of service)

Unchecked Return Value to NULL Pointer Dereference in tiffcrop in
libtiff 4.3.0 allows attackers to cause a denial-of-service via a
crafted tiff file.

- CVE-2022-0908 (denial of service)

Null source pointer passed as an argument to memcpy() function within
TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0
could lead to Denial of Service via crafted TIFF file.

- CVE-2022-0909 (denial of service)

A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers
to cause a denial-of-service via a crafted tiff file.

- CVE-2022-0924 (denial of service)

Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.

- CVE-2022-22844 (denial of service)

LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in
certain situations involving a custom tag and 0x0200 as the second word
of the DE field.

Impact
======

A remote attacker is able to crash the application or execute arbitrary
code on the affected host via a crafted tiff file.

References
==========

https://bugs.archlinux.org/task/74229
https://gitlab.com/libtiff/libtiff/-/issues/362
https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b
https://gitlab.com/libtiff/libtiff/-/issues/385
https://gitlab.com/libtiff/libtiff/-/merge_requests/306
https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067
https://gitlab.com/libtiff/libtiff/-/issues/380
https://gitlab.com/libtiff/libtiff/-/issues/382
https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
https://gitlab.com/libtiff/libtiff/-/issues/392
https://gitlab.com/libtiff/libtiff/-/merge_requests/314
https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc
https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85
https://gitlab.com/libtiff/libtiff/-/issues/383
https://gitlab.com/libtiff/libtiff/-/issues/393
https://gitlab.com/libtiff/libtiff/-/merge_requests/310
https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde
https://gitlab.com/libtiff/libtiff/-/issues/278
https://gitlab.com/libtiff/libtiff/-/merge_requests/311
https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a
https://gitlab.com/libtiff/libtiff/-/issues/355
https://gitlab.com/libtiff/libtiff/-/merge_requests/287
https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64
https://security.archlinux.org/CVE-2022-0561
https://security.archlinux.org/CVE-2022-0562
https://security.archlinux.org/CVE-2022-0865
https://security.archlinux.org/CVE-2022-0891
https://security.archlinux.org/CVE-2022-0907
https://security.archlinux.org/CVE-2022-0908
https://security.archlinux.org/CVE-2022-0909
https://security.archlinux.org/CVE-2022-0924
https://security.archlinux.org/CVE-2022-22844
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20220407/2e26d41f/attachment.sig>