CVE-2022-40090

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.(CVE-2022-40090)

Root has patched CVE-2022-40090 in the tiff package for Root:Debian:11. Multiple fixed versions available.

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)
• libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)
• libtiff: integer overflow in tiffcp.c (CVE-2023-40745)
• libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)
• libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2024-7006: check return value of _TIFFCreateAnonField() to avoid potential DoS via memory allocation failures
• CVE-2023-6228: validate input image codec in tiffcp to prevent heap-based buffer overflow and potential application crash
• CVE-2022-40090: improve IFD loop handling in TIFFReadDirectory to prevent DoS via crafted TIFF files
• CVE-2023-2731: handle missing end-of-information marker in LZWDecode() to prevent NULL pointer dereference and potential DoS

An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

This update for tiff fixes the following issues:

• CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478).
• CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231).
• CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398).
• CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

This update for tiff fixes the following issues:

• CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478).
• CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231).
• CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398).
• CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

It was discovered that LibTIFF could be made to run into an infinite loop. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2022-40090)

It was discovered that LibTIFF could be made leak memory. If a user or an automated system were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of service. (CVE-2023-3576)