Change logs for tiff source package in Cosmic

  • tiff (4.0.9-6ubuntu0.2) cosmic-security; urgency=medium
    
      * SECURITY UPDATE: heap over-read in TIFFWriteScanline
        - debian/patches/CVE-2018-10779.patch: fix overflow in
          libtiff/tif_write.c.
        - CVE-2018-10779
      * SECURITY UPDATE: heap over-read in cpSeparateBufToContigBuf
        - debian/patches/CVE-2018-12900-1.patch: check for overflow in
          tools/tiffcp.c.
        - debian/patches/CVE-2018-12900-2.patch: use INT_MAX in tools/tiffcp.c.
        - CVE-2018-12900
        - CVE-2019-7663
      * SECURITY UPDATE: NULL pointer dereference in _TIFFmemcmp
        - debian/patches/CVE-2018-17000.patch: add NULL check in
          libtiff/tif_dirwrite.c.
        - CVE-2018-17000
      * SECURITY UPDATE: NULL pointer dereference in TIFFWriteDirectorySec
        - debian/patches/CVE-2018-19210-1.patch: unset transferfunction field
          if necessary in libtiff/tif_dir.c.
        - debian/patches/CVE-2018-19210-2.patch: fix warning in
          libtiff/tif_dir.c.
        - CVE-2018-19210
      * SECURITY UPDATE: memory leak in TIFFFdOpen
        - debian/patches/CVE-2019-6128.patch: properly handle errors in
          tools/pal2rgb.c.
        - CVE-2019-6128
    
     -- Marc Deslauriers <email address hidden>  Mon, 11 Mar 2019 11:10:30 -0400
  • tiff (4.0.9-6ubuntu0.1) cosmic-security; urgency=medium
    
      * SECURITY UPDATE: multiple overflows
        - debian/patches/CVE-2018-1710x.patch: Avoid overflows in
          tools/pal2rgb.c, tools/tiff2bw.c, tools/ppm2tiff.c.
        - CVE-2018-17100
        - CVE-2018-17101
      * SECURITY UPDATE: JBIGDecode out-of-bounds write
        - debian/patches/CVE-2018-18557.patch: fix issue in libtiff/tif_jbig.c,
          libtiff/tif_read.c.
        - CVE-2018-18557
      * SECURITY UPDATE: NULL pointer dereference in LZWDecode
        - debian/patches/CVE-2018-18661.patch: add checks to tools/tiff2bw.c.
        - CVE-2018-18661
    
     -- Marc Deslauriers <email address hidden>  Thu, 17 Jan 2019 09:02:26 -0500
  • tiff (4.0.9-6) unstable; urgency=high
    
      * Fix CVE-2018-8905: eap-based buffer overflow in LZWDecodeCompat()
        (closes: #893806).
      * Fix CVE-2018-10963: remote denial of service (closes: #898348).
    
     -- Laszlo Boszormenyi (GCS) <email address hidden>  Sun, 01 Jul 2018 19:46:23 +0000
  • tiff (4.0.9-5) unstable; urgency=high
    
      * Fix CVE-2017-11613: avoid memory exhaustion in
        ChopUpSingleUncompressedStrip() (closes: #869823).
      * Fix CVE-2018-7456: NULL pointer dereference in TIFFPrintDirectory()
        (closes: #891288).
      * Fix CVE-2017-17095: heap-based buffer overflow in pal2rgb tool
        (closes: #883320).
      * Don't specify parallel to debhelper.
      * Update Standards-Version to 4.1.4 .
    
     -- Laszlo Boszormenyi (GCS) <email address hidden>  Sun, 15 Apr 2018 18:13:42 +0000