Bug 1205392 - (CVE-2022-3970) VUL-0: CVE-2022-3970: tiff: unsigned integer overflow in TIFFReadRGBATileExt()
(CVE-2022-3970)
VUL-0: CVE-2022-3970: tiff: unsigned integer overflow in TIFFReadRGBATileExt()
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Michael Vetter
Security Team bot
https://smash.suse.de/issue/347886/
CVSSv3.1:SUSE:CVE-2022-3970:7.8:(AV:L...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-11-14 10:56 UTC by Carlos López
Modified: 2023-01-16 08:03 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-11-14 10:56:36 UTC
CVE-2022-3970

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3970
http://www.cvedetails.com/cve/CVE-2022-3970/
Comment 1 Carlos López 2022-11-14 10:57:34 UTC
Affected:
- SUSE:SLE-11:Update
- SUSE:SLE-12:Update
- SUSE:SLE-15:Update
- openSUSE:Factory

Patch:
https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be
Comment 2 OBSbugzilla Bot 2022-11-14 13:35:13 UTC
This is an autogenerated message for OBS integration:
This bug (1205392) was mentioned in
https://build.opensuse.org/request/show/1035628 Factory / tiff
Comment 3 Michael Vetter 2022-11-15 15:58:15 UTC
I have the fixes for CVE-2022-3597 [bsc#1204641] CVE-2022-3626 [bsc#1204644] CVE-2022-3627 [bsc#1204645] CVE-2022-3599 [bsc#1204643] and CVE-2022-3970 [bsc#1205392] in my for SLE12 and SLE15 at https://build.suse.de/project/show/home:mvetter:bv.
All of them are already submitted to Factory.

I am/was still working on CVE-2022-3598 [bsc#1204642] which is a little harder since a lot of code changes happened. I will comment on this bug with more details.

Today I also received CVE-2022-3570 [bsc#1205422] which looks like the same as CVE-2022-3598.

I will be on vacation and will try to find someone who can work on the last remaining CVE and then make a submission. In case any of the fixed bugs are urgent we could also do a submssion already from my home:mvetter:bv to SLE12/SLE15.
Comment 7 Swamp Workflow Management 2022-11-28 14:22:26 UTC
SUSE-SU-2022:4248-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1204641,1204643,1204644,1204645,1205392
CVE References: CVE-2022-3597,CVE-2022-3599,CVE-2022-3626,CVE-2022-3627,CVE-2022-3970
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    tiff-4.0.9-44.59.1
SUSE OpenStack Cloud 9 (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Server 12-SP5 (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    tiff-4.0.9-44.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    tiff-4.0.9-44.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2022-11-28 20:28:11 UTC
SUSE-SU-2022:4259-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1204641,1204643,1204644,1204645,1205392
CVE References: CVE-2022-3597,CVE-2022-3599,CVE-2022-3626,CVE-2022-3627,CVE-2022-3970
JIRA References: 
Sources used:
openSUSE Leap Micro 5.3 (src):    tiff-4.0.9-150000.45.19.1
openSUSE Leap Micro 5.2 (src):    tiff-4.0.9-150000.45.19.1
openSUSE Leap 15.4 (src):    tiff-4.0.9-150000.45.19.1
openSUSE Leap 15.3 (src):    tiff-4.0.9-150000.45.19.1
SUSE Manager Server 4.1 (src):    tiff-4.0.9-150000.45.19.1
SUSE Manager Retail Branch Server 4.1 (src):    tiff-4.0.9-150000.45.19.1
SUSE Manager Proxy 4.1 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server for SAP 15 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Server 15-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Micro 5.3 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise Micro 5.2 (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    tiff-4.0.9-150000.45.19.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    tiff-4.0.9-150000.45.19.1
SUSE Enterprise Storage 7 (src):    tiff-4.0.9-150000.45.19.1
SUSE Enterprise Storage 6 (src):    tiff-4.0.9-150000.45.19.1
SUSE CaaS Platform 4.0 (src):    tiff-4.0.9-150000.45.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.