USN-5421-1: LibTIFF vulnerabilities | Cloud Foundry

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 16.04
• Canonical Ubuntu 18.04

Description

It was discovered that LibTIFF incorrectly handled certain images. An attacker could possibly use this issue to cause a crash, resulting in a denial of service. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35522) Chintan Shah discovered that LibTIFF incorrectly handled memory when handling certain images. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-0561, CVE-2022-0562, CVE-2022-0891) It was discovered that LibTIFF incorrectly handled certain images. An attacker could possibly use this issue to cause a crash, resulting in a denial of service. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2022-0865) Update Instructions: Run sudo ua fix USN-5421-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libtiff-opengl – 4.0.6-1ubuntu0.8+esm1 libtiffxx5 – 4.0.6-1ubuntu0.8+esm1 libtiff5-dev – 4.0.6-1ubuntu0.8+esm1 libtiff5 – 4.0.6-1ubuntu0.8+esm1 libtiff-tools – 4.0.6-1ubuntu0.8+esm1 libtiff-doc – 4.0.6-1ubuntu0.8+esm1 Available with UA Infra or UA Desktop: https://ubuntu.com/advantage

CVEs contained in this USN include: CVE-2020-35522, CVE-2022-0561, CVE-2022-0562, CVE-2022-0865, CVE-2022-0891.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs3
  • All versions prior to 0.297.0
• CF Deployment
  • All versions prior to 21.0.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs3
  • Upgrade all versions to 0.297.0 or greater
• CF Deployment
  • Upgrade all versions to 21.0.0 or greater

References

• USN Notice
• VMware Tanzu Disclosure
• CVE-2020-35522
• CVE-2022-0561
• CVE-2022-0562
• CVE-2022-0865
• CVE-2022-0891

History

2022-07-29: Initial vulnerability report published.