Bug 2054494 (CVE-2022-0561)

Summary:	CVE-2022-0561 libtiff: Denial of Service via crafted TIFF file
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	erik-fedora, mike, mmuzila, nforro, phracek, rh-spice-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy() function within the TIFFFetchStripThing() in tif_dirread.c. This flaw allows an attacker with a crafted TIFF file to exploit this flaw, causing a crash and leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-06 20:16:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2054497, 2054499, 2055138, 2055139, 2055140
Bug Blocks:	2054500

Description Sandipan Roy 2022-02-15 04:35:26 UTC

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
https://gitlab.com/libtiff/libtiff/-/issues/362
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json

Comment 1 Sandipan Roy 2022-02-15 04:43:38 UTC

Created libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2054499]


Created mingw-libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2054497]

Comment 4 errata-xmlrpc 2022-11-08 09:45:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7585 https://access.redhat.com/errata/RHSA-2022:7585

Comment 5 errata-xmlrpc 2022-11-15 10:35:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8194 https://access.redhat.com/errata/RHSA-2022:8194

Comment 6 Product Security DevOps Team 2022-12-06 20:16:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0561