Ubuntu
tiff package

Change logs for tiff source package in Kinetic

Kinetic (22.10)
Change log

tiff (4.4.0-4ubuntu3.3) kinetic-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds reads
    - debian/patches/CVE-2023-0795.patch: Amend rotateImage() not to toggle the
      input image width and length parameters when only cropped image sections
      are rotated in tiffcrop.c.
    - CVE-2023-0795
    - CVE-2023-0796
    - CVE-2023-0797
    - CVE-2023-0798
    - CVE-2023-0799
  * SECURITY UPDATE: out-of-bounds writes
    - debian/patches/CVE-2023-0800.patch: added check for assumption on
      composite images in tiffcrop.c.
    - CVE-2023-0800
    - CVE-2023-0801
    - CVE-2023-0802
    - CVE-2023-0803
    - CVE-2023-0804

 -- Fabian Toepfer <email address hidden>  Fri, 03 Mar 2023 16:44:34 +0100

tiff (4.4.0-4ubuntu3.2) kinetic-security; urgency=critical

  * Backport security fix for CVE-2022-3970, fix (unsigned) integer overflow
    on strips/tiles > 2 GB in TIFFReadRGBATileExt() (closes: #1024737).

 -- Rico Tzschichholz <email address hidden>  Wed, 30 Nov 2022 16:24:00 +0100

tiff (4.4.0-4ubuntu3.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: heap-overflow and double free in tiffcrop
    - debian/patches/CVE-2022-2519_2520_2521_2953.patch: Add checks and ends
      tiffcrop if -S arguments are not mutually exclusive.
    - CVE-2022-2519
    - CVE-2022-2520
    - CVE-2022-2521
    - CVE-2022-2953
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2022-3570_3598.patch: increases buffer sizes for
      subroutines in tools/tiffcrop.c.
    - CVE-2022-3570
    - CVE-2022-3598
  * SECURITY UPDATE: out-of-bound write in tiffcrop
    - debian/patches/CVE-2022-3599.patch: Revised handling of TIFFTAG_INKNAMES
      and related TIFFTAG_NUMBEROFINKS value
    - CVE-2022-3599
  * SECURITY UPDATE: out-of-bound write in tif_unix
    - debian/patches/CVE-2022-3626_3627.patch: disable incompatibility of -Z,
      -X, -Y, -z options with any PAGE_MODE_x option
    - CVE-2022-3626
    - CVE-2022-3627

 -- Nishit Majithia <email address hidden>  Wed, 02 Nov 2022 14:13:19 +0530

tiff (4.4.0-4ubuntu3) kinetic; urgency=medium

  * Don't build with LERC on i386 because it requires numpy (Closes: #1017958)

 -- Jeremy Bicha <email address hidden>  Tue, 23 Aug 2022 11:30:38 -0400

tiff (4.4.0-4ubuntu2) kinetic; urgency=medium

  * Drop this delta as the MIR (LP #1977551) was approved (this package
    can be a sync now):
    - d/control, d/libtiff5.symbols: drop liblerc-dev build-dependency and
      the TIFFInitLERC symbol since that library is in universe and tiff
      is in main (LP #1984327)

 -- Andreas Hasenack <email address hidden>  Thu, 18 Aug 2022 10:19:04 -0300

tiff (4.4.0-4ubuntu1) kinetic; urgency=medium

  * d/control, d/libtiff5.symbols: drop liblerc-dev build-dependency and
    the TIFFInitLERC symbol since that library is in universe and tiff
    is in main (LP: #1984327)

 -- Andreas Hasenack <email address hidden>  Wed, 10 Aug 2022 15:40:59 -0300

tiff (4.4.0-4) unstable; urgency=high

  * Backport security fix for CVE-2022-34526, denial of service via a crafted
    TIFF file.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Sat, 06 Aug 2022 15:19:15 +0200

tiff (4.4.0-3) unstable; urgency=high

  * Backport security fix for CVE-2022-2056, CVE-2022-2057 and CVE-2022-2058,
    divide by zero error in tiffcrop (closes: #1014494).
  * Update libtiff5 symbols.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Fri, 08 Jul 2022 19:02:43 +0200

tiff (4.4.0-2) unstable; urgency=medium

  * Adjust library symbols with LERC build architectures.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Mon, 30 May 2022 18:04:05 +0200

tiff (4.4.0-1) unstable; urgency=medium

  * New upstream release.
  * Backport upstream fix for adding 4.4.0 changes file to documentation.
  * Build with LERC compression support (closes: #990789).
  * Update libtiff5 symbols.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Sun, 29 May 2022 12:28:49 +0200

tiff (4.4.0~rc1-1) unstable; urgency=medium

  * New upstream release candidate version.
  * Update libtiff5 symbols.
  * Update watch file.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Sat, 21 May 2022 15:41:44 +0200

tiff (4.3.0-8) unstable; urgency=high

  * Backport correct security fix for CVE-2022-1355, stack buffer overflow in
    "mode" string (closes: #1011160).

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Tue, 17 May 2022 21:38:14 +0200

tiff (4.3.0-7) unstable; urgency=high

  * Backport security fix for CVE-2022-1354, heap buffer overflow in
    TIFFReadRawDataStriped().
  * Fix segmentation fault printing GPS directory if Altitude tag is present.
  * Fix segmentation fault due to field_name=NULL.
  * Backport security fix for CVE-2022-1355, stack buffer overflow in "mode"
    string.
  * Update libtiff5 symbols.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Mon, 25 Apr 2022 22:24:06 +0200

tiff (4.3.0-6) unstable; urgency=high

  * Backport security fix for CVE-2022-0908, null source pointer passed as an
    argument to memcpy() function within TIFFFetchNormalTag().
  * Backport security fix for CVE-2022-0907, unchecked return value to null
    pointer dereference in tiffcrop.
  * Backport security fix for CVE-2022-0909, divide by zero error in
    tiffcrop.
  * Backport security fix for CVE-2022-0891, heap buffer overflow in
    ExtractImageSection function in tiffcrop.
  * Backport security fix for CVE-2022-0924, heap buffer overflow in tiffcp.

 -- Laszlo Boszormenyi (GCS) <email address hidden>  Sun, 13 Mar 2022 11:00:15 +0100

Ubuntutiff package

Change logs for tiff source package in Kinetic

Ubuntu
tiff package