More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2207635 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Use the following template to for the 'fedpkg update' request to submit an update for this issue as it contains the top-level parent bug(s) as well as this tracking bug. This will ensure that all associated bugs get updated when new packages are pushed to stable. ===== # bugfix, security, enhancement, newpackage (required) type=security # low, medium, high, urgent (required) severity=medium # testing, stable request=testing # Bug numbers: 1234,9876 bugs=2207635,2207638 # Description of your update notes=Security fix for [PUT CVEs HERE] # Enable request automation based on the stable/unstable karma thresholds autokarma=True stable_karma=3 unstable_karma=-3 # Automatically close bugs when this marked as stable close_bugs=True # Suggest that users restart after update suggest_reboot=False ====== Additionally, you may opt to use the bodhi web interface to submit updates: https://bodhi.fedoraproject.org/updates/new
I took a look at the fix and the surrounding code mentioned in bug 2207635. It appears the code the fix applies to has been largely rewritten for 4.x in: https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/42173d6ace476b5228d866640b5355f74e5a108d The CVE may still apply, but I'm unsure on how to test that. If it applies, we should be able to carry a patch. The actual fix commit upstream looks trivial.
The bundled libtiff in iv is very old. We, neuro-sig, looked into the code and concluded that the CVEs filed against iv regarding libtiff are either not applicable or, if they are, do not pose a high risk due to the nature of the iv package and its intended audience. IV, the InterViews graphical library, is consumed only by NEURON, a neuroscience application for modelling neurons and networks thereof. Therefore, we decided in our meeting on 4 December 2023 [1] not to pursue this further.
The missing link (sorry about the additional noise): [1] https://meetbot.fedoraproject.org/neuro_matrix_fedoraproject-org/2023-12-04/neurofedora-2023-12-04.2023-12-04-13.02.html