DSA-5333: -1 tiff -- security update
Several buffer overflow, divide by zero or out of bounds read/write vulnerabilities were discovered in tiff, the Tag Image File Format (TIFF) library and tools, which may cause denial of service when processing a crafted TIFF image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tiffto a version that resolves this vulnerability.Patch DSA-5333-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2022-1354
- CVE-2022-1355
- CVE-2022-1622
- CVE-2022-1623
- CVE-2022-2056
- CVE-2022-2057
- CVE-2022-2058
- CVE-2022-2519
- CVE-2022-2520
- CVE-2022-2521
- CVE-2022-2867
- CVE-2022-2868
- CVE-2022-2869
- CVE-2022-2953
- CVE-2022-3570
- CVE-2022-3597
- CVE-2022-3599
- CVE-2022-3627
- CVE-2022-34526
- CVE-2022-48281
- CVE-2022-3598
- CVE-2022-3626
- CVE-2022-3970
- CVE-2022-4645
Frequently Asked Questions
What is the practical impact of processing a malicious TIFF file?
The reported flaws can cause denial of service when the TIFF library or its tools process a crafted TIFF image. The vulnerability types include buffer overflows, divide-by-zero conditions, and out-of-bounds reads or writes.
What systems are exposed?
Systems using the Debian tiff package are relevant to this update, particularly where TIFF images may be processed by the library or its tools.