Vulnerability-Lookup

CVE-2019-17546 (GCVE-0-2019-17546)

Vulnerability from cvelistv5 – Published: 2019-10-14 01:07 – Updated: 2024-12-20 13:06

Summary

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

11 references

URL	Tags
https://github.com/OSGeo/gdal/commit/21674033ee24…	x_refsource_MISC
https://gitlab.com/libtiff/libtiff/commit/4bb584a…	x_refsource_MISC
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://seclists.org/bugtraq/2020/Jan/32	mailing-listx_refsource_BUGTRAQ
https://www.debian.org/security/2020/dsa-4608	vendor-advisoryx_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202003-25	vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2020/dsa-4670	vendor-advisoryx_refsource_DEBIAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-20T13:06:38.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
          },
          {
            "name": "[debian-lts-announce] 20191126 [SECURITY] [DLA 2009-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
          },
          {
            "name": "20200121 [SECURITY] [DSA 4608-1] tiff security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/32"
          },
          {
            "name": "DSA-4608",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4608"
          },
          {
            "name": "FEDORA-2020-2e9bd06377",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
          },
          {
            "name": "FEDORA-2020-6f1209bb45",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
          },
          {
            "name": "GLSA-202003-25",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-25"
          },
          {
            "name": "[debian-lts-announce] 20200318 [SECURITY] [DLA 2147-1] gdal security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
          },
          {
            "name": "DSA-4670",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4670"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241220-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-30T12:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
        },
        {
          "name": "[debian-lts-announce] 20191126 [SECURITY] [DLA 2009-1] tiff security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
        },
        {
          "name": "20200121 [SECURITY] [DSA 4608-1] tiff security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/32"
        },
        {
          "name": "DSA-4608",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4608"
        },
        {
          "name": "FEDORA-2020-2e9bd06377",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
        },
        {
          "name": "FEDORA-2020-6f1209bb45",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
        },
        {
          "name": "GLSA-202003-25",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-25"
        },
        {
          "name": "[debian-lts-announce] 20200318 [SECURITY] [DLA 2147-1] gdal security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
        },
        {
          "name": "DSA-4670",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4670"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-17546",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf",
              "refsource": "MISC",
              "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
            },
            {
              "name": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145",
              "refsource": "MISC",
              "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
            },
            {
              "name": "[debian-lts-announce] 20191126 [SECURITY] [DLA 2009-1] tiff security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
            },
            {
              "name": "20200121 [SECURITY] [DSA 4608-1] tiff security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/32"
            },
            {
              "name": "DSA-4608",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4608"
            },
            {
              "name": "FEDORA-2020-2e9bd06377",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
            },
            {
              "name": "FEDORA-2020-6f1209bb45",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
            },
            {
              "name": "GLSA-202003-25",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-25"
            },
            {
              "name": "[debian-lts-announce] 20200318 [SECURITY] [DLA 2147-1] gdal security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
            },
            {
              "name": "DSA-4670",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4670"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-17546",
    "datePublished": "2019-10-14T01:07:02.000Z",
    "dateReserved": "2019-10-14T00:00:00.000Z",
    "dateUpdated": "2024-12-20T13:06:38.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-17546",
      "date": "2026-05-26",
      "epss": "0.00373",
      "percentile": "0.59122"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.1.0\", \"matchCriteriaId\": \"D2AFBC8F-DBB5-411F-996F-51E4DBF5737C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.0.1\", \"matchCriteriaId\": \"028B7E48-C2D6-43D1-B740-8CE5070B115E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \\\"Negative-size-param\\\" condition.\"}, {\"lang\": \"es\", \"value\": \"El archivo tif_getimage.c en LibTIFF versiones hasta 4.0.10, como es usado en GDAL hasta 3.0.1 y otros productos, presenta un desbordamiento de enteros que causa potencialmente un desbordamiento de b\\u00fafer en la regi\\u00f3n heap de la memoria por medio de una imagen RGBA dise\\u00f1ada, relacionada con una condici\\u00f3n \\\"Negative-size-param\\\".\"}]",
      "id": "CVE-2019-17546",
      "lastModified": "2024-12-20T13:15:16.870",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2019-10-14T02:15:11.107",
      "references": "[{\"url\": \"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://seclists.org/bugtraq/2020/Jan/32\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/202003-25\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4608\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4670\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://seclists.org/bugtraq/2020/Jan/32\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202003-25\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241220-0007/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4608\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4670\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-190\"}, {\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-17546\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-10-14T02:15:11.107\",\"lastModified\":\"2024-12-20T13:15:16.870\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \\\"Negative-size-param\\\" condition.\"},{\"lang\":\"es\",\"value\":\"El archivo tif_getimage.c en LibTIFF versiones hasta 4.0.10, como es usado en GDAL hasta 3.0.1 y otros productos, presenta un desbordamiento de enteros que causa potencialmente un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria por medio de una imagen RGBA dise\u00f1ada, relacionada con una condici\u00f3n \\\"Negative-size-param\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.0\",\"matchCriteriaId\":\"D2AFBC8F-DBB5-411F-996F-51E4DBF5737C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.0.1\",\"matchCriteriaId\":\"028B7E48-C2D6-43D1-B740-8CE5070B115E\"}]}]}],\"references\":[{\"url\":\"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://seclists.org/bugtraq/2020/Jan/32\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202003-25\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4608\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4670\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://seclists.org/bugtraq/2020/Jan/32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202003-25\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20241220-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4608\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2020/dsa-4670\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}

CERTFR-2024-AVI-1103

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	Cognos Analytics	Cognos Analytics versions 12.0.x antérieures à 12.0.4
IBM	Sterling	Sterling External Authentication Server versions 6.1.0.x antérieures à 6.1.0.2 ifix 01
IBM	QRadar SIEM	Security QRadar Log Management AQL Plugin versions antérieures à 1.1.0
IBM	Sterling	Sterling Secure Proxy versions 6.0.x antérieures à 6.0.3.1 (fixpack) GA
IBM	Cognos Analytics	Cognos Analytics versions 11.2.x antérieures à 11.2.4 FP5
IBM	Sterling	Sterling Secure Proxy versions 6.1.x antérieures à 6.1.0.1 (fixpack) GA
IBM	Sterling	Sterling Secure Proxy versions 6.2.x antérieures à 6.2.0.0 ifix 01
IBM	Sterling Connect:Direct	Sterling Connect:Direct Web Services versions 6.3.x antérieures à 6.3.0.11_ifix001

References

Title

Publication Time

CERTFR-2024-AVI-1103

Vulnerability from certfr_avis - Published: - Updated:

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	Cognos Analytics	Cognos Analytics versions 12.0.x antérieures à 12.0.4
IBM	Sterling	Sterling External Authentication Server versions 6.1.0.x antérieures à 6.1.0.2 ifix 01
IBM	QRadar SIEM	Security QRadar Log Management AQL Plugin versions antérieures à 1.1.0
IBM	Sterling	Sterling Secure Proxy versions 6.0.x antérieures à 6.0.3.1 (fixpack) GA
IBM	Cognos Analytics	Cognos Analytics versions 11.2.x antérieures à 11.2.4 FP5
IBM	Sterling	Sterling Secure Proxy versions 6.1.x antérieures à 6.1.0.1 (fixpack) GA
IBM	Sterling	Sterling Secure Proxy versions 6.2.x antérieures à 6.2.0.0 ifix 01
IBM	Sterling Connect:Direct	Sterling Connect:Direct Web Services versions 6.3.x antérieures à 6.3.0.11_ifix001

References

Title

Publication Time

alsa-2020:4634

Vulnerability from osv_almalinux

Published

2020-11-03 12:22

Modified

2021-08-11 08:54

Summary

Moderate: libtiff security update

Details

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

URL

Type

https://vulners.com/cve/CVE-2019-17546

REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libtiff-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.9-18.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2020:4634",
  "modified": "2021-08-11T08:54:00Z",
  "published": "2020-11-03T12:22:21Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-17546"
    }
  ],
  "related": [
    "CVE-2019-17546"
  ],
  "summary": "Moderate: libtiff security update"
}

BDU:2021-03591

Vulnerability from fstec - Published: 14.10.2019

Title

Уязвимость компонента tif_getimage.c библиотеки LibTIFF, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Description

Уязвимость компонента tif_getimage.c библиотеки LibTIFF связана с ошибкой переполнения буфера, которое может потенциально привести к переполнению буфера кучи через созданный RGBA-образ, связанный с условием "Nagative-size-param". Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Severity


                    
                      AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vendor

Сообщество свободного программного обеспечения, ООО «РусБИТех-Астра», Silicon Graphics Corp., АО «Концерн ВНИИНС», АО «НТЦ ИТ РОСА»

Software Name

Debian GNU/Linux, Astra Linux Special Edition (запись в едином реестре российских программ №369), LibTIFF, Astra Linux Special Edition для «Эльбрус» (запись в едином реестре российских программ №11156), ОС ОН «Стрелец» (запись в едином реестре российских программ №6177), ROSA Virtualization 3.0 (запись в едином реестре российских программ №21308)

Software Version

9 (Debian GNU/Linux), 1.6 «Смоленск» (Astra Linux Special Edition), 8 (Debian GNU/Linux), 10 (Debian GNU/Linux), до 4.0.10 включительно (LibTIFF), 8.1 «Ленинград» (Astra Linux Special Edition для «Эльбрус»), до 4.1.0 (LibTIFF), до 16.01.2023 (ОС ОН «Стрелец»), 3.0 (ROSA Virtualization 3.0)

Possible Mitigations

Для LibTIFF: Использование рекомендаций производителя: https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145 Для Debian: Использование рекомендаций производителя: https://security-tracker.debian.org/tracker/CVE-2019-17546 Для Astra Linux: Использование рекомендаций производителя: https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16 https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 Для ОС ОН «Стрелец»: Обновление программного обеспечения tiff до версии 4.0.8-2+deb9u8 Для программной системы управления средой виртуализации с подсистемой безагентного резервного копирования виртуальных машин «ROSA Virtualization 3.0»: https://abf.rosa.ru/advisories/ROSA-SA-2025-2708

Reference

https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145 https://nvd.nist.gov/vuln/detail/CVE-2019-17546 https://security-tracker.debian.org/tracker/CVE-2019-17546 https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16 https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023 https://abf.rosa.ru/advisories/ROSA-SA-2025-2708

CWE

CWE-787

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Silicon Graphics Corp., \u0410\u041e \u00ab\u041a\u043e\u043d\u0446\u0435\u0440\u043d \u0412\u041d\u0418\u0418\u041d\u0421\u00bb, \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "9 (Debian GNU/Linux), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition), 8 (Debian GNU/Linux), 10 (Debian GNU/Linux), \u0434\u043e 4.0.10 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (LibTIFF), 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb (Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb), \u0434\u043e 4.1.0 (LibTIFF), \u0434\u043e 16.01.2023 (\u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb), 3.0 (ROSA Virtualization 3.0)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f LibTIFF:\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\n\n\u0414\u043b\u044f Debian:\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://security-tracker.debian.org/tracker/CVE-2019-17546\n\n\u0414\u043b\u044f Astra Linux:\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16\nhttps://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81\n\n\u0414\u043b\u044f \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f tiff \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 4.0.8-2+deb9u8\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0431\u0435\u0437\u0430\u0433\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u00abROSA Virtualization 3.0\u00bb: https://abf.rosa.ru/advisories/ROSA-SA-2025-2708",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.10.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.03.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "13.07.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-03591",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-17546",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), LibTIFF, Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21166177), ROSA Virtualization 3.0 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211621308)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 9 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Silicon Graphics Corp. LibTIFF \u0434\u043e 4.0.10 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition \u0434\u043b\u044f \u00ab\u042d\u043b\u044c\u0431\u0440\u0443\u0441\u00bb 8.1 \u00ab\u041b\u0435\u043d\u0438\u043d\u0433\u0440\u0430\u0434\u00bb  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211611156), Silicon Graphics Corp. LibTIFF \u0434\u043e 4.1.0 , \u0410\u041e \u00ab\u041a\u043e\u043d\u0446\u0435\u0440\u043d \u0412\u041d\u0418\u0418\u041d\u0421\u00bb \u041e\u0421 \u041e\u041d \u00ab\u0421\u0442\u0440\u0435\u043b\u0435\u0446\u00bb \u0434\u043e 16.01.2023  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21166177), \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb ROSA Virtualization 3.0 3.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211621308)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 tif_getimage.c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LibTIFF, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c, \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0438\u0445 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 tif_getimage.c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LibTIFF \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043a\u0443\u0447\u0438 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 RGBA-\u043e\u0431\u0440\u0430\u0437, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0443\u0441\u043b\u043e\u0432\u0438\u0435\u043c \"Nagative-size-param\". \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c, \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0438\u0445 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf\nhttps://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-17546\nhttps://security-tracker.debian.org/tracker/CVE-2019-17546\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16\nhttps://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81\nhttps://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023\nhttps://abf.rosa.ru/advisories/ROSA-SA-2025-2708",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-787",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,8)"
}

CNVD-2020-13553

Vulnerability from cnvd - Published: 2020-02-26

Title

Silicon Graphics LibTIFF整数溢出漏洞（CNVD-2020-13553）

Description

Silicon Graphics LibTIFF是美国Silicon Graphics公司的一个读写TIFF（标签图像文件格式）文件的库。该库包含一些处理TIFF文件的命令行工具。GDAL是一款开源的地理空间数据抽象库。 Silicon Graphics 3.0.1及之前版本和其他产品中所使用的LibTIFF 4.0.10及之前版本的tif_getimage.c文件存在整数溢出漏洞，攻击者可通过特制RGBA图像利用该漏洞导致堆缓冲区溢出。

Severity

中

Patch Name

Silicon Graphics LibTIFF整数溢出漏洞（CNVD-2020-13553）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-17546

Impacted products

Name
['Silicon Graphics LibTIFF <=3.0.1', 'Silicon Graphics LibTIFF <=4.0.10']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-17546",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-17546"
    }
  },
  "description": "Silicon Graphics LibTIFF\u662f\u7f8e\u56fdSilicon Graphics\u516c\u53f8\u7684\u4e00\u4e2a\u8bfb\u5199TIFF\uff08\u6807\u7b7e\u56fe\u50cf\u6587\u4ef6\u683c\u5f0f\uff09\u6587\u4ef6\u7684\u5e93\u3002\u8be5\u5e93\u5305\u542b\u4e00\u4e9b\u5904\u7406TIFF\u6587\u4ef6\u7684\u547d\u4ee4\u884c\u5de5\u5177\u3002GDAL\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u5730\u7406\u7a7a\u95f4\u6570\u636e\u62bd\u8c61\u5e93\u3002\n\nSilicon Graphics 3.0.1\u53ca\u4e4b\u524d\u7248\u672c\u548c\u5176\u4ed6\u4ea7\u54c1\u4e2d\u6240\u4f7f\u7528\u7684LibTIFF 4.0.10\u53ca\u4e4b\u524d\u7248\u672c\u7684tif_getimage.c\u6587\u4ef6\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u7279\u5236RGBA\u56fe\u50cf\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-13553",
  "openTime": "2020-02-26",
  "patchDescription": "Silicon Graphics LibTIFF\u662f\u7f8e\u56fdSilicon Graphics\u516c\u53f8\u7684\u4e00\u4e2a\u8bfb\u5199TIFF\uff08\u6807\u7b7e\u56fe\u50cf\u6587\u4ef6\u683c\u5f0f\uff09\u6587\u4ef6\u7684\u5e93\u3002\u8be5\u5e93\u5305\u542b\u4e00\u4e9b\u5904\u7406TIFF\u6587\u4ef6\u7684\u547d\u4ee4\u884c\u5de5\u5177\u3002GDAL\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u5730\u7406\u7a7a\u95f4\u6570\u636e\u62bd\u8c61\u5e93\u3002\r\n\r\nSilicon Graphics 3.0.1\u53ca\u4e4b\u524d\u7248\u672c\u548c\u5176\u4ed6\u4ea7\u54c1\u4e2d\u6240\u4f7f\u7528\u7684LibTIFF 4.0.10\u53ca\u4e4b\u524d\u7248\u672c\u7684tif_getimage.c\u6587\u4ef6\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u7279\u5236RGBA\u56fe\u50cf\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Silicon Graphics LibTIFF\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-13553\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Silicon Graphics LibTIFF \u003c=3.0.1",
      "Silicon Graphics LibTIFF \u003c=4.0.10"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-17546",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-14",
  "title": "Silicon Graphics LibTIFF\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-13553\uff09"
}

FKIE_CVE-2019-17546

Vulnerability from fkie_nvd - Published: 2019-10-14 02:15 - Updated: 2024-12-20 13:15

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@mitre.org	https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443	Third Party Advisory
cve@mitre.org	https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf	Patch, Third Party Advisory
cve@mitre.org	https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145	Patch, Third Party Advisory
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html	Third Party Advisory
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/
cve@mitre.org	https://seclists.org/bugtraq/2020/Jan/32
cve@mitre.org	https://security.gentoo.org/glsa/202003-25
cve@mitre.org	https://www.debian.org/security/2020/dsa-4608
cve@mitre.org	https://www.debian.org/security/2020/dsa-4670
af854a3a-2127-422b-91ae-364da2661108	https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/
af854a3a-2127-422b-91ae-364da2661108	https://seclists.org/bugtraq/2020/Jan/32
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/202003-25
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20241220-0007/
af854a3a-2127-422b-91ae-364da2661108	https://www.debian.org/security/2020/dsa-4608
af854a3a-2127-422b-91ae-364da2661108	https://www.debian.org/security/2020/dsa-4670

Impacted products

	Vendor	Product	Version
	libtiff	libtiff	*
	osgeo	gdal	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2AFBC8F-DBB5-411F-996F-51E4DBF5737C",
              "versionEndExcluding": "4.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "028B7E48-C2D6-43D1-B740-8CE5070B115E",
              "versionEndIncluding": "3.0.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition."
    },
    {
      "lang": "es",
      "value": "El archivo tif_getimage.c en LibTIFF versiones hasta 4.0.10, como es usado en GDAL hasta 3.0.1 y otros productos, presenta un desbordamiento de enteros que causa potencialmente un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria por medio de una imagen RGBA dise\u00f1ada, relacionada con una condici\u00f3n \"Negative-size-param\"."
    }
  ],
  "id": "CVE-2019-17546",
  "lastModified": "2024-12-20T13:15:16.870",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-10-14T02:15:11.107",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://seclists.org/bugtraq/2020/Jan/32"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/202003-25"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.debian.org/security/2020/dsa-4608"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.debian.org/security/2020/dsa-4670"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://seclists.org/bugtraq/2020/Jan/32"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202003-25"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20241220-0007/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.debian.org/security/2020/dsa-4608"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.debian.org/security/2020/dsa-4670"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-24M4-FMX6-C2Q6

Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-12-20 15:30

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-17546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-14T02:15:00Z",
    "severity": "MODERATE"
  },
  "details": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition.",
  "id": "GHSA-24m4-fmx6-c2q6",
  "modified": "2024-12-20T15:30:43Z",
  "published": "2022-05-24T16:58:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17546"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
    },
    {
      "type": "WEB",
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2020/Jan/32"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202003-25"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20241220-0007"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4608"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4670"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2019-17546

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-17546

Aliases

CVE-2019-17546

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-17546",
    "description": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition.",
    "id": "GSD-2019-17546",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-17546.html",
      "https://www.debian.org/security/2020/dsa-4670",
      "https://www.debian.org/security/2020/dsa-4608",
      "https://access.redhat.com/errata/RHSA-2020:4634",
      "https://access.redhat.com/errata/RHSA-2020:3902",
      "https://ubuntu.com/security/CVE-2019-17546",
      "https://advisories.mageia.org/CVE-2019-17546.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2019-17546.html",
      "https://linux.oracle.com/cve/CVE-2019-17546.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-17546"
      ],
      "details": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition.",
      "id": "GSD-2019-17546",
      "modified": "2023-12-13T01:23:44.547603Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2019-17546",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf",
            "refsource": "MISC",
            "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
          },
          {
            "name": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145",
            "refsource": "MISC",
            "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
          },
          {
            "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443",
            "refsource": "MISC",
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
          },
          {
            "name": "[debian-lts-announce] 20191126 [SECURITY] [DLA 2009-1] tiff security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
          },
          {
            "name": "20200121 [SECURITY] [DSA 4608-1] tiff security update",
            "refsource": "BUGTRAQ",
            "url": "https://seclists.org/bugtraq/2020/Jan/32"
          },
          {
            "name": "DSA-4608",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2020/dsa-4608"
          },
          {
            "name": "FEDORA-2020-2e9bd06377",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
          },
          {
            "name": "FEDORA-2020-6f1209bb45",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
          },
          {
            "name": "GLSA-202003-25",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202003-25"
          },
          {
            "name": "[debian-lts-announce] 20200318 [SECURITY] [DLA 2147-1] gdal security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
          },
          {
            "name": "DSA-4670",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2020/dsa-4670"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:osgeo:gdal:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.0.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-17546"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                },
                {
                  "lang": "en",
                  "value": "CWE-190"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443"
            },
            {
              "name": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145"
            },
            {
              "name": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf"
            },
            {
              "name": "[debian-lts-announce] 20191126 [SECURITY] [DLA 2009-1] tiff security update",
              "refsource": "MLIST",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html"
            },
            {
              "name": "20200121 [SECURITY] [DSA 4608-1] tiff security update",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "https://seclists.org/bugtraq/2020/Jan/32"
            },
            {
              "name": "DSA-4608",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2020/dsa-4608"
            },
            {
              "name": "FEDORA-2020-2e9bd06377",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/"
            },
            {
              "name": "FEDORA-2020-6f1209bb45",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/"
            },
            {
              "name": "GLSA-202003-25",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/202003-25"
            },
            {
              "name": "[debian-lts-announce] 20200318 [SECURITY] [DLA 2147-1] gdal security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html"
            },
            {
              "name": "DSA-4670",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2020/dsa-4670"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-08-24T17:37Z",
      "publishedDate": "2019-10-14T02:15Z"
    }
  }
}

OPENSUSE-SU-2022:0480-1

Vulnerability from csaf_opensuse - Published: 2022-02-17 14:11 - Updated: 2022-02-17 14:11

Summary

Security update for tiff

Severity

Important

Notes

Title of the patch: Security update for tiff

Description of the patch: This update for tiff fixes the following issues: - CVE-2017-17095: Fixed DoS in tools/pal2rgb.c in pal2rgb (bsc#1071031). - CVE-2019-17546: Fixed integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image (bsc#1154365). - CVE-2020-19131: Fixed buffer overflow in tiffcrop that may cause DoS via the invertImage() function (bsc#1190312). - CVE-2020-35521: Fixed memory allocation failure in tif_read.c (bsc#1182808). - CVE-2020-35522: Fixed memory allocation failure in tif_pixarlog.c (bsc#1182809). - CVE-2020-35523: Fixed integer overflow in tif_getimage.c (bsc#1182811). - CVE-2020-35524: Fixed heap-based buffer overflow in TIFF2PDF tool (bsc#1182812). - CVE-2022-22844: Fixed out-of-bounds read in _TIFFmemcpy in tif_unix.c (bsc#1194539).

Patchnames: openSUSE-SLE-15.3-2022-480,openSUSE-SLE-15.4-2022-480

CVE-2017-17095

8.1 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2019-17546

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2020-19131

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35521

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35522

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35523

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35524

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2022-22844

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 14 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

40 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://lists.opensuse.org/archives/list/security…	self
https://lists.opensuse.org/archives/list/security…	self
https://bugzilla.suse.com/1071031	self
https://bugzilla.suse.com/1154365	self
https://bugzilla.suse.com/1182808	self
https://bugzilla.suse.com/1182809	self
https://bugzilla.suse.com/1182811	self
https://bugzilla.suse.com/1182812	self
https://bugzilla.suse.com/1190312	self
https://bugzilla.suse.com/1194539	self
https://www.suse.com/security/cve/CVE-2017-17095/	self
https://www.suse.com/security/cve/CVE-2019-17546/	self
https://www.suse.com/security/cve/CVE-2020-19131/	self
https://www.suse.com/security/cve/CVE-2020-35521/	self
https://www.suse.com/security/cve/CVE-2020-35522/	self
https://www.suse.com/security/cve/CVE-2020-35523/	self
https://www.suse.com/security/cve/CVE-2020-35524/	self
https://www.suse.com/security/cve/CVE-2022-22844/	self
https://www.suse.com/security/cve/CVE-2017-17095	external
https://bugzilla.suse.com/1071031	external
https://www.suse.com/security/cve/CVE-2019-17546	external
https://bugzilla.suse.com/1154365	external
https://www.suse.com/security/cve/CVE-2020-19131	external
https://bugzilla.suse.com/1190312	external
https://www.suse.com/security/cve/CVE-2020-35521	external
https://bugzilla.suse.com/1182808	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35522	external
https://bugzilla.suse.com/1182809	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35523	external
https://bugzilla.suse.com/1182811	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35524	external
https://bugzilla.suse.com/1182812	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2022-22844	external
https://bugzilla.suse.com/1194539	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tiff",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tiff fixes the following issues:\n\n- CVE-2017-17095: Fixed DoS in tools/pal2rgb.c in pal2rgb (bsc#1071031).\n- CVE-2019-17546: Fixed integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image (bsc#1154365).\n- CVE-2020-19131: Fixed buffer overflow in tiffcrop that may cause DoS via the invertImage() function (bsc#1190312).\n- CVE-2020-35521: Fixed memory allocation failure in tif_read.c (bsc#1182808).\n- CVE-2020-35522: Fixed memory allocation failure in tif_pixarlog.c (bsc#1182809).\n- CVE-2020-35523: Fixed integer overflow in tif_getimage.c (bsc#1182811).\n- CVE-2020-35524: Fixed heap-based buffer overflow in TIFF2PDF tool (bsc#1182812).\n- CVE-2022-22844: Fixed out-of-bounds read in _TIFFmemcpy in tif_unix.c (bsc#1194539).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-SLE-15.3-2022-480,openSUSE-SLE-15.4-2022-480",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_0480-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2022:0480-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OF4G5SOPBRKT4CZJV5MAQLV5LXXFO62/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2022:0480-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OF4G5SOPBRKT4CZJV5MAQLV5LXXFO62/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1071031",
        "url": "https://bugzilla.suse.com/1071031"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1154365",
        "url": "https://bugzilla.suse.com/1154365"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182808",
        "url": "https://bugzilla.suse.com/1182808"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182809",
        "url": "https://bugzilla.suse.com/1182809"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182811",
        "url": "https://bugzilla.suse.com/1182811"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1182812",
        "url": "https://bugzilla.suse.com/1182812"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1190312",
        "url": "https://bugzilla.suse.com/1190312"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1194539",
        "url": "https://bugzilla.suse.com/1194539"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-17095 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-17095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17546 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17546/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-19131 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-19131/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35521 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35521/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35522 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35522/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35523 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35523/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35524 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-22844 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-22844/"
      }
    ],
    "title": "Security update for tiff",
    "tracking": {
      "current_release_date": "2022-02-17T14:11:19Z",
      "generator": {
        "date": "2022-02-17T14:11:19Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2022:0480-1",
      "initial_release_date": "2022-02-17T14:11:19Z",
      "revision_history": [
        {
          "date": "2022-02-17T14:11:19Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.0.9-45.5.1.aarch64",
                "product": {
                  "name": "libtiff-devel-4.0.9-45.5.1.aarch64",
                  "product_id": "libtiff-devel-4.0.9-45.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff5-4.0.9-45.5.1.aarch64",
                "product": {
                  "name": "libtiff5-4.0.9-45.5.1.aarch64",
                  "product_id": "libtiff5-4.0.9-45.5.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.0.9-45.5.1.aarch64",
                "product": {
                  "name": "tiff-4.0.9-45.5.1.aarch64",
                  "product_id": "tiff-4.0.9-45.5.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.0.9-45.5.1.ppc64le",
                "product": {
                  "name": "libtiff-devel-4.0.9-45.5.1.ppc64le",
                  "product_id": "libtiff-devel-4.0.9-45.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff5-4.0.9-45.5.1.ppc64le",
                "product": {
                  "name": "libtiff5-4.0.9-45.5.1.ppc64le",
                  "product_id": "libtiff5-4.0.9-45.5.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.0.9-45.5.1.ppc64le",
                "product": {
                  "name": "tiff-4.0.9-45.5.1.ppc64le",
                  "product_id": "tiff-4.0.9-45.5.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.0.9-45.5.1.s390x",
                "product": {
                  "name": "libtiff-devel-4.0.9-45.5.1.s390x",
                  "product_id": "libtiff-devel-4.0.9-45.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff5-4.0.9-45.5.1.s390x",
                "product": {
                  "name": "libtiff5-4.0.9-45.5.1.s390x",
                  "product_id": "libtiff5-4.0.9-45.5.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.0.9-45.5.1.s390x",
                "product": {
                  "name": "tiff-4.0.9-45.5.1.s390x",
                  "product_id": "tiff-4.0.9-45.5.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.0.9-45.5.1.x86_64",
                "product": {
                  "name": "libtiff-devel-4.0.9-45.5.1.x86_64",
                  "product_id": "libtiff-devel-4.0.9-45.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
                "product": {
                  "name": "libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
                  "product_id": "libtiff-devel-32bit-4.0.9-45.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff5-4.0.9-45.5.1.x86_64",
                "product": {
                  "name": "libtiff5-4.0.9-45.5.1.x86_64",
                  "product_id": "libtiff5-4.0.9-45.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff5-32bit-4.0.9-45.5.1.x86_64",
                "product": {
                  "name": "libtiff5-32bit-4.0.9-45.5.1.x86_64",
                  "product_id": "libtiff5-32bit-4.0.9-45.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.0.9-45.5.1.x86_64",
                "product": {
                  "name": "tiff-4.0.9-45.5.1.x86_64",
                  "product_id": "tiff-4.0.9-45.5.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.0.9-45.5.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64"
        },
        "product_reference": "libtiff-devel-4.0.9-45.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.0.9-45.5.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le"
        },
        "product_reference": "libtiff-devel-4.0.9-45.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.0.9-45.5.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x"
        },
        "product_reference": "libtiff-devel-4.0.9-45.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.0.9-45.5.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64"
        },
        "product_reference": "libtiff-devel-4.0.9-45.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-32bit-4.0.9-45.5.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64"
        },
        "product_reference": "libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff5-4.0.9-45.5.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64"
        },
        "product_reference": "libtiff5-4.0.9-45.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff5-4.0.9-45.5.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le"
        },
        "product_reference": "libtiff5-4.0.9-45.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff5-4.0.9-45.5.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x"
        },
        "product_reference": "libtiff5-4.0.9-45.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff5-4.0.9-45.5.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64"
        },
        "product_reference": "libtiff5-4.0.9-45.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff5-32bit-4.0.9-45.5.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64"
        },
        "product_reference": "libtiff5-32bit-4.0.9-45.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.0.9-45.5.1.aarch64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64"
        },
        "product_reference": "tiff-4.0.9-45.5.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.0.9-45.5.1.ppc64le as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le"
        },
        "product_reference": "tiff-4.0.9-45.5.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.0.9-45.5.1.s390x as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x"
        },
        "product_reference": "tiff-4.0.9-45.5.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.0.9-45.5.1.x86_64 as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        },
        "product_reference": "tiff-4.0.9-45.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-17095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-17095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-17095",
          "url": "https://www.suse.com/security/cve/CVE-2017-17095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1071031 for CVE-2017-17095",
          "url": "https://bugzilla.suse.com/1071031"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-17095"
    },
    {
      "cve": "CVE-2019-17546",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17546"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17546",
          "url": "https://www.suse.com/security/cve/CVE-2019-17546"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1154365 for CVE-2019-17546",
          "url": "https://bugzilla.suse.com/1154365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17546"
    },
    {
      "cve": "CVE-2020-19131",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-19131"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the \"invertImage()\" function in the component \"tiffcrop\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-19131",
          "url": "https://www.suse.com/security/cve/CVE-2020-19131"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1190312 for CVE-2020-19131",
          "url": "https://bugzilla.suse.com/1190312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-19131"
    },
    {
      "cve": "CVE-2020-35521",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35521"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35521",
          "url": "https://www.suse.com/security/cve/CVE-2020-35521"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182808 for CVE-2020-35521",
          "url": "https://bugzilla.suse.com/1182808"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35521",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35521"
    },
    {
      "cve": "CVE-2020-35522",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35522"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35522",
          "url": "https://www.suse.com/security/cve/CVE-2020-35522"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182809 for CVE-2020-35522",
          "url": "https://bugzilla.suse.com/1182809"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35522",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35522"
    },
    {
      "cve": "CVE-2020-35523",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35523"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35523",
          "url": "https://www.suse.com/security/cve/CVE-2020-35523"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182811 for CVE-2020-35523",
          "url": "https://bugzilla.suse.com/1182811"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35523",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35523"
    },
    {
      "cve": "CVE-2020-35524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff\u0027s TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35524",
          "url": "https://www.suse.com/security/cve/CVE-2020-35524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182812 for CVE-2020-35524",
          "url": "https://bugzilla.suse.com/1182812"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35524",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35524"
    },
    {
      "cve": "CVE-2022-22844",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-22844"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
          "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-22844",
          "url": "https://www.suse.com/security/cve/CVE-2022-22844"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194539 for CVE-2022-22844",
          "url": "https://bugzilla.suse.com/1194539"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:libtiff-devel-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff-devel-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-32bit-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:libtiff5-4.0.9-45.5.1.x86_64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.aarch64",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.ppc64le",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.s390x",
            "openSUSE Leap 15.3:tiff-4.0.9-45.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-02-17T14:11:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-22844"
    }
  ]
}

OPENSUSE-SU-2024:13381-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

libtiff-devel-32bit-4.6.0-2.1 on GA media

Severity

Moderate

Notes

Title of the patch: libtiff-devel-32bit-4.6.0-2.1 on GA media

Description of the patch: These are all security issues fixed in the libtiff-devel-32bit-4.6.0-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2024-13381

CVE-2016-10092

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2016-6223

9.1 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2017-12944

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2017-17095

8.1 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2019-14973

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2019-17546

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2020-19131

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35521

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35522

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35523

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2020-35524

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2022-22844

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2022-2867

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2022-2868

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2022-2869

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2022-34266

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64	—	Vendor Fix

Threats

Impact important

References

57 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2016-10092/	self
https://www.suse.com/security/cve/CVE-2016-6223/	self
https://www.suse.com/security/cve/CVE-2017-12944/	self
https://www.suse.com/security/cve/CVE-2017-17095/	self
https://www.suse.com/security/cve/CVE-2019-14973/	self
https://www.suse.com/security/cve/CVE-2019-17546/	self
https://www.suse.com/security/cve/CVE-2020-19131/	self
https://www.suse.com/security/cve/CVE-2020-35521/	self
https://www.suse.com/security/cve/CVE-2020-35522/	self
https://www.suse.com/security/cve/CVE-2020-35523/	self
https://www.suse.com/security/cve/CVE-2020-35524/	self
https://www.suse.com/security/cve/CVE-2022-22844/	self
https://www.suse.com/security/cve/CVE-2022-2867/	self
https://www.suse.com/security/cve/CVE-2022-2868/	self
https://www.suse.com/security/cve/CVE-2022-2869/	self
https://www.suse.com/security/cve/CVE-2022-34266/	self
https://www.suse.com/security/cve/CVE-2016-10092	external
https://bugzilla.suse.com/1017693	external
https://bugzilla.suse.com/1122679	external
https://www.suse.com/security/cve/CVE-2016-6223	external
https://bugzilla.suse.com/990460	external
https://www.suse.com/security/cve/CVE-2017-12944	external
https://bugzilla.suse.com/1003874	external
https://bugzilla.suse.com/1054594	external
https://www.suse.com/security/cve/CVE-2017-17095	external
https://bugzilla.suse.com/1071031	external
https://www.suse.com/security/cve/CVE-2019-14973	external
https://bugzilla.suse.com/1146608	external
https://www.suse.com/security/cve/CVE-2019-17546	external
https://bugzilla.suse.com/1154365	external
https://www.suse.com/security/cve/CVE-2020-19131	external
https://bugzilla.suse.com/1190312	external
https://www.suse.com/security/cve/CVE-2020-35521	external
https://bugzilla.suse.com/1182808	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35522	external
https://bugzilla.suse.com/1182809	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35523	external
https://bugzilla.suse.com/1182811	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2020-35524	external
https://bugzilla.suse.com/1182812	external
https://bugzilla.suse.com/1200195	external
https://www.suse.com/security/cve/CVE-2022-22844	external
https://bugzilla.suse.com/1194539	external
https://www.suse.com/security/cve/CVE-2022-2867	external
https://bugzilla.suse.com/1202466	external
https://www.suse.com/security/cve/CVE-2022-2868	external
https://bugzilla.suse.com/1202467	external
https://www.suse.com/security/cve/CVE-2022-2869	external
https://bugzilla.suse.com/1202468	external
https://www.suse.com/security/cve/CVE-2022-34266	external
https://bugzilla.suse.com/1201723	external
https://bugzilla.suse.com/1208311	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libtiff-devel-32bit-4.6.0-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libtiff-devel-32bit-4.6.0-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13381",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13381-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-10092 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-10092/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-6223 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-6223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-12944 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-12944/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-17095 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-17095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14973 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14973/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17546 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17546/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-19131 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-19131/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35521 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35521/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35522 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35522/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35523 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35523/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35524 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-22844 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-22844/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-2867 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-2867/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-2868 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-2868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-2869 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-2869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-34266 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-34266/"
      }
    ],
    "title": "libtiff-devel-32bit-4.6.0-2.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13381-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.6.0-2.1.aarch64",
                "product": {
                  "name": "libtiff-devel-4.6.0-2.1.aarch64",
                  "product_id": "libtiff-devel-4.6.0-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-32bit-4.6.0-2.1.aarch64",
                "product": {
                  "name": "libtiff-devel-32bit-4.6.0-2.1.aarch64",
                  "product_id": "libtiff-devel-32bit-4.6.0-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-4.6.0-2.1.aarch64",
                "product": {
                  "name": "libtiff6-4.6.0-2.1.aarch64",
                  "product_id": "libtiff6-4.6.0-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-32bit-4.6.0-2.1.aarch64",
                "product": {
                  "name": "libtiff6-32bit-4.6.0-2.1.aarch64",
                  "product_id": "libtiff6-32bit-4.6.0-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.6.0-2.1.aarch64",
                "product": {
                  "name": "tiff-4.6.0-2.1.aarch64",
                  "product_id": "tiff-4.6.0-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.6.0-2.1.ppc64le",
                "product": {
                  "name": "libtiff-devel-4.6.0-2.1.ppc64le",
                  "product_id": "libtiff-devel-4.6.0-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-32bit-4.6.0-2.1.ppc64le",
                "product": {
                  "name": "libtiff-devel-32bit-4.6.0-2.1.ppc64le",
                  "product_id": "libtiff-devel-32bit-4.6.0-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-4.6.0-2.1.ppc64le",
                "product": {
                  "name": "libtiff6-4.6.0-2.1.ppc64le",
                  "product_id": "libtiff6-4.6.0-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-32bit-4.6.0-2.1.ppc64le",
                "product": {
                  "name": "libtiff6-32bit-4.6.0-2.1.ppc64le",
                  "product_id": "libtiff6-32bit-4.6.0-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.6.0-2.1.ppc64le",
                "product": {
                  "name": "tiff-4.6.0-2.1.ppc64le",
                  "product_id": "tiff-4.6.0-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.6.0-2.1.s390x",
                "product": {
                  "name": "libtiff-devel-4.6.0-2.1.s390x",
                  "product_id": "libtiff-devel-4.6.0-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-32bit-4.6.0-2.1.s390x",
                "product": {
                  "name": "libtiff-devel-32bit-4.6.0-2.1.s390x",
                  "product_id": "libtiff-devel-32bit-4.6.0-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-4.6.0-2.1.s390x",
                "product": {
                  "name": "libtiff6-4.6.0-2.1.s390x",
                  "product_id": "libtiff6-4.6.0-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-32bit-4.6.0-2.1.s390x",
                "product": {
                  "name": "libtiff6-32bit-4.6.0-2.1.s390x",
                  "product_id": "libtiff6-32bit-4.6.0-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.6.0-2.1.s390x",
                "product": {
                  "name": "tiff-4.6.0-2.1.s390x",
                  "product_id": "tiff-4.6.0-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-devel-4.6.0-2.1.x86_64",
                "product": {
                  "name": "libtiff-devel-4.6.0-2.1.x86_64",
                  "product_id": "libtiff-devel-4.6.0-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-32bit-4.6.0-2.1.x86_64",
                "product": {
                  "name": "libtiff-devel-32bit-4.6.0-2.1.x86_64",
                  "product_id": "libtiff-devel-32bit-4.6.0-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-4.6.0-2.1.x86_64",
                "product": {
                  "name": "libtiff6-4.6.0-2.1.x86_64",
                  "product_id": "libtiff6-4.6.0-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtiff6-32bit-4.6.0-2.1.x86_64",
                "product": {
                  "name": "libtiff6-32bit-4.6.0-2.1.x86_64",
                  "product_id": "libtiff6-32bit-4.6.0-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tiff-4.6.0-2.1.x86_64",
                "product": {
                  "name": "tiff-4.6.0-2.1.x86_64",
                  "product_id": "tiff-4.6.0-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.6.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64"
        },
        "product_reference": "libtiff-devel-4.6.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.6.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le"
        },
        "product_reference": "libtiff-devel-4.6.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.6.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x"
        },
        "product_reference": "libtiff-devel-4.6.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-4.6.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64"
        },
        "product_reference": "libtiff-devel-4.6.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-32bit-4.6.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64"
        },
        "product_reference": "libtiff-devel-32bit-4.6.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-32bit-4.6.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le"
        },
        "product_reference": "libtiff-devel-32bit-4.6.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-32bit-4.6.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x"
        },
        "product_reference": "libtiff-devel-32bit-4.6.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-32bit-4.6.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64"
        },
        "product_reference": "libtiff-devel-32bit-4.6.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.6.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64"
        },
        "product_reference": "libtiff6-4.6.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.6.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le"
        },
        "product_reference": "libtiff6-4.6.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.6.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x"
        },
        "product_reference": "libtiff6-4.6.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-4.6.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64"
        },
        "product_reference": "libtiff6-4.6.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-32bit-4.6.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64"
        },
        "product_reference": "libtiff6-32bit-4.6.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-32bit-4.6.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le"
        },
        "product_reference": "libtiff6-32bit-4.6.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-32bit-4.6.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x"
        },
        "product_reference": "libtiff6-32bit-4.6.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff6-32bit-4.6.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64"
        },
        "product_reference": "libtiff6-32bit-4.6.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.6.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64"
        },
        "product_reference": "tiff-4.6.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.6.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le"
        },
        "product_reference": "tiff-4.6.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.6.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x"
        },
        "product_reference": "tiff-4.6.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tiff-4.6.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        },
        "product_reference": "tiff-4.6.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-10092",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-10092"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-10092",
          "url": "https://www.suse.com/security/cve/CVE-2016-10092"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1017693 for CVE-2016-10092",
          "url": "https://bugzilla.suse.com/1017693"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122679 for CVE-2016-10092",
          "url": "https://bugzilla.suse.com/1122679"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-10092"
    },
    {
      "cve": "CVE-2016-6223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-6223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-6223",
          "url": "https://www.suse.com/security/cve/CVE-2016-6223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 990460 for CVE-2016-6223",
          "url": "https://bugzilla.suse.com/990460"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-6223"
    },
    {
      "cve": "CVE-2017-12944",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-12944"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-12944",
          "url": "https://www.suse.com/security/cve/CVE-2017-12944"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003874 for CVE-2017-12944",
          "url": "https://bugzilla.suse.com/1003874"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1054594 for CVE-2017-12944",
          "url": "https://bugzilla.suse.com/1054594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-12944"
    },
    {
      "cve": "CVE-2017-17095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-17095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-17095",
          "url": "https://www.suse.com/security/cve/CVE-2017-17095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1071031 for CVE-2017-17095",
          "url": "https://bugzilla.suse.com/1071031"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-17095"
    },
    {
      "cve": "CVE-2019-14973",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14973"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14973",
          "url": "https://www.suse.com/security/cve/CVE-2019-14973"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1146608 for CVE-2019-14973",
          "url": "https://bugzilla.suse.com/1146608"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-14973"
    },
    {
      "cve": "CVE-2019-17546",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17546"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a \"Negative-size-param\" condition.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17546",
          "url": "https://www.suse.com/security/cve/CVE-2019-17546"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1154365 for CVE-2019-17546",
          "url": "https://bugzilla.suse.com/1154365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17546"
    },
    {
      "cve": "CVE-2020-19131",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-19131"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the \"invertImage()\" function in the component \"tiffcrop\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-19131",
          "url": "https://www.suse.com/security/cve/CVE-2020-19131"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1190312 for CVE-2020-19131",
          "url": "https://bugzilla.suse.com/1190312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-19131"
    },
    {
      "cve": "CVE-2020-35521",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35521"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35521",
          "url": "https://www.suse.com/security/cve/CVE-2020-35521"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182808 for CVE-2020-35521",
          "url": "https://bugzilla.suse.com/1182808"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35521",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35521"
    },
    {
      "cve": "CVE-2020-35522",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35522"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35522",
          "url": "https://www.suse.com/security/cve/CVE-2020-35522"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182809 for CVE-2020-35522",
          "url": "https://bugzilla.suse.com/1182809"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35522",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35522"
    },
    {
      "cve": "CVE-2020-35523",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35523"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35523",
          "url": "https://www.suse.com/security/cve/CVE-2020-35523"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182811 for CVE-2020-35523",
          "url": "https://bugzilla.suse.com/1182811"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35523",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35523"
    },
    {
      "cve": "CVE-2020-35524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff\u0027s TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35524",
          "url": "https://www.suse.com/security/cve/CVE-2020-35524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182812 for CVE-2020-35524",
          "url": "https://bugzilla.suse.com/1182812"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200195 for CVE-2020-35524",
          "url": "https://bugzilla.suse.com/1200195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-35524"
    },
    {
      "cve": "CVE-2022-22844",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-22844"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-22844",
          "url": "https://www.suse.com/security/cve/CVE-2022-22844"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194539 for CVE-2022-22844",
          "url": "https://bugzilla.suse.com/1194539"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-22844"
    },
    {
      "cve": "CVE-2022-2867",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-2867"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libtiff\u0027s tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-2867",
          "url": "https://www.suse.com/security/cve/CVE-2022-2867"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1202466 for CVE-2022-2867",
          "url": "https://bugzilla.suse.com/1202466"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2022-2867"
    },
    {
      "cve": "CVE-2022-2868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-2868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libtiff\u0027s tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-2868",
          "url": "https://www.suse.com/security/cve/CVE-2022-2868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1202467 for CVE-2022-2868",
          "url": "https://bugzilla.suse.com/1202467"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2022-2868"
    },
    {
      "cve": "CVE-2022-2869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-2869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libtiff\u0027s tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-2869",
          "url": "https://www.suse.com/security/cve/CVE-2022-2869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1202468 for CVE-2022-2869",
          "url": "https://bugzilla.suse.com/1202468"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2022-2869"
    },
    {
      "cve": "CVE-2022-34266",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-34266"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
          "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-34266",
          "url": "https://www.suse.com/security/cve/CVE-2022-34266"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201723 for CVE-2022-34266",
          "url": "https://bugzilla.suse.com/1201723"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208311 for CVE-2022-34266",
          "url": "https://bugzilla.suse.com/1208311"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff-devel-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-32bit-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:libtiff6-4.6.0-2.1.x86_64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.aarch64",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.ppc64le",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.s390x",
            "openSUSE Tumbleweed:tiff-4.6.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-34266"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2019-17546 (GCVE-0-2019-17546)

Solutions

Solutions

Vulnerability from osv_almalinux

Tags

Sightings

Nomenclature