-
tiff (4.0.9-6ubuntu0.2) cosmic-security; urgency=medium
* SECURITY UPDATE: heap over-read in TIFFWriteScanline
- debian/patches/CVE-2018-10779.patch: fix overflow in
libtiff/tif_write.c.
- CVE-2018-10779
* SECURITY UPDATE: heap over-read in cpSeparateBufToContigBuf
- debian/patches/CVE-2018-12900-1.patch: check for overflow in
tools/tiffcp.c.
- debian/patches/CVE-2018-12900-2.patch: use INT_MAX in tools/tiffcp.c.
- CVE-2018-12900
- CVE-2019-7663
* SECURITY UPDATE: NULL pointer dereference in _TIFFmemcmp
- debian/patches/CVE-2018-17000.patch: add NULL check in
libtiff/tif_dirwrite.c.
- CVE-2018-17000
* SECURITY UPDATE: NULL pointer dereference in TIFFWriteDirectorySec
- debian/patches/CVE-2018-19210-1.patch: unset transferfunction field
if necessary in libtiff/tif_dir.c.
- debian/patches/CVE-2018-19210-2.patch: fix warning in
libtiff/tif_dir.c.
- CVE-2018-19210
* SECURITY UPDATE: memory leak in TIFFFdOpen
- debian/patches/CVE-2019-6128.patch: properly handle errors in
tools/pal2rgb.c.
- CVE-2019-6128
-- Marc Deslauriers <email address hidden> Mon, 11 Mar 2019 11:10:30 -0400
-
tiff (4.0.9-6ubuntu0.1) cosmic-security; urgency=medium
* SECURITY UPDATE: multiple overflows
- debian/patches/CVE-2018-1710x.patch: Avoid overflows in
tools/pal2rgb.c, tools/tiff2bw.c, tools/ppm2tiff.c.
- CVE-2018-17100
- CVE-2018-17101
* SECURITY UPDATE: JBIGDecode out-of-bounds write
- debian/patches/CVE-2018-18557.patch: fix issue in libtiff/tif_jbig.c,
libtiff/tif_read.c.
- CVE-2018-18557
* SECURITY UPDATE: NULL pointer dereference in LZWDecode
- debian/patches/CVE-2018-18661.patch: add checks to tools/tiff2bw.c.
- CVE-2018-18661
-- Marc Deslauriers <email address hidden> Thu, 17 Jan 2019 09:02:26 -0500
-
tiff (4.0.9-6) unstable; urgency=high
* Fix CVE-2018-8905: eap-based buffer overflow in LZWDecodeCompat()
(closes: #893806).
* Fix CVE-2018-10963: remote denial of service (closes: #898348).
-- Laszlo Boszormenyi (GCS) <email address hidden> Sun, 01 Jul 2018 19:46:23 +0000
-
tiff (4.0.9-5) unstable; urgency=high
* Fix CVE-2017-11613: avoid memory exhaustion in
ChopUpSingleUncompressedStrip() (closes: #869823).
* Fix CVE-2018-7456: NULL pointer dereference in TIFFPrintDirectory()
(closes: #891288).
* Fix CVE-2017-17095: heap-based buffer overflow in pal2rgb tool
(closes: #883320).
* Don't specify parallel to debhelper.
* Update Standards-Version to 4.1.4 .
-- Laszlo Boszormenyi (GCS) <email address hidden> Sun, 15 Apr 2018 18:13:42 +0000