OESA-2022-1551

Dashboard / Vulnerabilities / OESA-2022-1551

OESA-2022-1551

Summary: libtiff security update

Details: TIFF Library and Utilities. Security Fix(es): Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.(CVE-2022-0562) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.(CVE-2022-0561)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1551, https://nvd.nist.gov/vuln/detail/CVE-2022-0562, https://nvd.nist.gov/vuln/detail/CVE-2022-0561