Security update for tiff SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3679-1 Final 1 1 2022-10-20T13:17:33Z current 2022-10-20T13:17:33Z 2022-10-20T13:17:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: - CVE-2022-2519: Fixed a double free in rotateImage() (bsc#1202968). - CVE-2022-2520: Fixed a assertion failure in rotateImage() (bsc#1202973). - CVE-2022-2521: Fixed invalid free in TIFFClose() (bsc#1202971). - CVE-2022-2867: Fixed out of bounds read and write in tiffcrop.c (bsc#1202466). - CVE-2022-2868: Fixed out of bounds read in reverseSamples16bits() (bsc#1202467). - CVE-2022-2869: Fixed out of bounds read and write in extractContigSamples8bits() (bsc#1202468). - CVE-2022-34526: Fixed stack overflow in the _TIFFVGetField function of Tiffsplit (bsc#1202026). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-SAP-BYOS-2022-3679,Image SLES12-SP5-Azure-SAP-On-Demand-2022-3679,Image SLES12-SP5-EC2-SAP-BYOS-2022-3679,Image SLES12-SP5-EC2-SAP-On-Demand-2022-3679,Image SLES12-SP5-GCE-SAP-BYOS-2022-3679,Image SLES12-SP5-GCE-SAP-On-Demand-2022-3679,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2022-3679,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2022-3679,SUSE-2022-3679,SUSE-OpenStack-Cloud-9-2022-3679,SUSE-OpenStack-Cloud-Crowbar-9-2022-3679,SUSE-SLE-SAP-12-SP4-2022-3679,SUSE-SLE-SDK-12-SP5-2022-3679,SUSE-SLE-SERVER-12-SP2-BCL-2022-3679,SUSE-SLE-SERVER-12-SP3-BCL-2022-3679,SUSE-SLE-SERVER-12-SP4-LTSS-2022-3679,SUSE-SLE-SERVER-12-SP5-2022-3679 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ Link for SUSE-SU-2022:3679-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012592.html E-Mail link for SUSE-SU-2022:3679-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201723 SUSE Bug 1201723 https://bugzilla.suse.com/1201971 SUSE Bug 1201971 https://bugzilla.suse.com/1202026 SUSE Bug 1202026 https://bugzilla.suse.com/1202466 SUSE Bug 1202466 https://bugzilla.suse.com/1202467 SUSE Bug 1202467 https://bugzilla.suse.com/1202468 SUSE Bug 1202468 https://bugzilla.suse.com/1202968 SUSE Bug 1202968 https://bugzilla.suse.com/1202971 SUSE Bug 1202971 https://bugzilla.suse.com/1202973 SUSE Bug 1202973 https://www.suse.com/security/cve/CVE-2022-0561/ SUSE CVE CVE-2022-0561 page https://www.suse.com/security/cve/CVE-2022-2519/ SUSE CVE CVE-2022-2519 page https://www.suse.com/security/cve/CVE-2022-2520/ SUSE CVE CVE-2022-2520 page https://www.suse.com/security/cve/CVE-2022-2521/ SUSE CVE CVE-2022-2521 page https://www.suse.com/security/cve/CVE-2022-2867/ SUSE CVE CVE-2022-2867 page https://www.suse.com/security/cve/CVE-2022-2868/ SUSE CVE CVE-2022-2868 page https://www.suse.com/security/cve/CVE-2022-2869/ SUSE CVE CVE-2022-2869 page https://www.suse.com/security/cve/CVE-2022-34266/ SUSE CVE CVE-2022-34266 page https://www.suse.com/security/cve/CVE-2022-34526/ SUSE CVE CVE-2022-34526 page Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libtiff5-4.0.9-44.56.1 libtiff-devel-4.0.9-44.56.1 libtiff-devel-32bit-4.0.9-44.56.1 libtiff-devel-64bit-4.0.9-44.56.1 libtiff5-32bit-4.0.9-44.56.1 libtiff5-64bit-4.0.9-44.56.1 tiff-4.0.9-44.56.1 libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libtiff5-4.0.9-44.56.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP5 libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP5 tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server 12 SP5 libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libtiff5-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 tiff-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libtiff-devel-4.0.9-44.56.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libtiff5-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud 9 libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud 9 tiff-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud 9 libtiff5-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud Crowbar 9 libtiff5-32bit-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud Crowbar 9 tiff-4.0.9-44.56.1 as a component of SUSE OpenStack Cloud Crowbar 9 Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. CVE-2022-0561 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-0561.html CVE-2022-0561 https://bugzilla.suse.com/1195964 SUSE Bug 1195964 There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 CVE-2022-2519 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2519.html CVE-2022-2519 https://bugzilla.suse.com/1202968 SUSE Bug 1202968 https://bugzilla.suse.com/1205505 SUSE Bug 1205505 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. CVE-2022-2520 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2520.html CVE-2022-2520 https://bugzilla.suse.com/1202973 SUSE Bug 1202973 It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. CVE-2022-2521 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2521.html CVE-2022-2521 https://bugzilla.suse.com/1202971 SUSE Bug 1202971 https://bugzilla.suse.com/1205505 SUSE Bug 1205505 libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. CVE-2022-2867 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2867.html CVE-2022-2867 https://bugzilla.suse.com/1202466 SUSE Bug 1202466 libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. CVE-2022-2868 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2868.html CVE-2022-2868 https://bugzilla.suse.com/1202467 SUSE Bug 1202467 libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. CVE-2022-2869 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-2869.html CVE-2022-2869 https://bugzilla.suse.com/1202468 SUSE Bug 1202468 The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. CVE-2022-34266 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-34266.html CVE-2022-34266 https://bugzilla.suse.com/1201723 SUSE Bug 1201723 https://bugzilla.suse.com/1208311 SUSE Bug 1208311 A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. CVE-2022-34526 Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.56.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP2-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP3-BCL:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP4-LTSS:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.56.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.56.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud 9:tiff-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-32bit-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:libtiff5-4.0.9-44.56.1 SUSE OpenStack Cloud Crowbar 9:tiff-4.0.9-44.56.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223679-1/ https://www.suse.com/security/cve/CVE-2022-34526.html CVE-2022-34526 https://bugzilla.suse.com/1202026 SUSE Bug 1202026 https://bugzilla.suse.com/1205073 SUSE Bug 1205073 https://bugzilla.suse.com/1205505 SUSE Bug 1205505 https://bugzilla.suse.com/1208338 SUSE Bug 1208338