Bugzilla – Bug 1204642
VUL-0: CVE-2022-3598: tiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c
Last modified: 2023-04-10 16:50:10 UTC
CVE-2022-3598 LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. Upstream commit: https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3598 https://www.cve.org/CVERecord?id=CVE-2022-3598 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json https://gitlab.com/libtiff/libtiff/-/issues/435
This is an autogenerated message for OBS integration: This bug (1204642) was mentioned in https://build.opensuse.org/request/show/1035543 Factory / tiff
This is an autogenerated message for OBS integration: This bug (1204642) was mentioned in https://build.opensuse.org/request/show/1035628 Factory / tiff
I have the fixes for CVE-2022-3597 [bsc#1204641] CVE-2022-3626 [bsc#1204644] CVE-2022-3627 [bsc#1204645] CVE-2022-3599 [bsc#1204643] and CVE-2022-3970 [bsc#1205392] in my for SLE12 and SLE15 at https://build.suse.de/project/show/home:mvetter:bv. All of them are already submitted to Factory. I will be on vacation and will try to find someone who can work on the last remaining CVE and then make a submission. In case any of the fixed bugs are urgent we could also do a submssion already from my home:mvetter:bv to SLE12/SLE15. I am/was still working on this bug CVE-2022-3598 [bsc#1204642] which is a little harder since a lot of code changes happened. Today I also received CVE-2022-3570 [bsc#1205422] which looks like the same as this bug. Unfortunately I can't finish this bug before my vacation. What I found out so far: Upstream fix commit is: https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff But I think we will also need: * https://gitlab.com/libtiff/libtiff/-/commit/aac006e57 to check correctly for the buff size * https://gitlab.com/libtiff/libtiff/-/commit/1f3e801d962b4912d62590fbcfa36c82202a3662 to add the limitMalloc function which enforces memory allocation limit * https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb3 to add checks to the usage of limitMalloc to prevent a SEGV In all the mentioned patches we need to adapt the code like: * uint32_t -> uint32 (same for uint16 etc) * `%"PRIu16"` -> `%u` * `%"PRIu32"` -> `%u` * `%"PRIu64"` -> `%lu`
Created attachment 862944 [details] This is the backport of those commits mentioned in c4
SUSE-SU-2022:4411-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1204642,1205422 CVE References: CVE-2022-3570,CVE-2022-3598 JIRA References: Sources used: openSUSE Leap Micro 5.3 (src): tiff-4.0.9-150000.45.22.1 openSUSE Leap Micro 5.2 (src): tiff-4.0.9-150000.45.22.1 openSUSE Leap 15.4 (src): tiff-4.0.9-150000.45.22.1 openSUSE Leap 15.3 (src): tiff-4.0.9-150000.45.22.1 SUSE Manager Server 4.1 (src): tiff-4.0.9-150000.45.22.1 SUSE Manager Retail Branch Server 4.1 (src): tiff-4.0.9-150000.45.22.1 SUSE Manager Proxy 4.1 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server for SAP 15 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Server 15-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Micro 5.3 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise Micro 5.2 (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): tiff-4.0.9-150000.45.22.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): tiff-4.0.9-150000.45.22.1 SUSE Enterprise Storage 7 (src): tiff-4.0.9-150000.45.22.1 SUSE Enterprise Storage 6 (src): tiff-4.0.9-150000.45.22.1 SUSE CaaS Platform 4.0 (src): tiff-4.0.9-150000.45.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:0060-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1204642,1205422 CVE References: CVE-2022-3570,CVE-2022-3598 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): tiff-4.0.9-44.62.1 SUSE Linux Enterprise Server 12-SP5 (src): tiff-4.0.9-44.62.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.