summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libtiff
AgeCommit message (Collapse)Author
2024-02-24meta: Update CVE_STATUS for incorrect cpesSimone Weiß
Set CVE_STATUS as none of the issues apply against the versions used in the recipes. Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-08tiff: fix CVE-2023-52355 and CVE-2023-52356Yogita Urade
CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. Issue fixed by providing a documentation update. CVE-2023-52356: A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. References: https://nvd.nist.gov/vuln/detail/CVE-2023-52355 https://security-tracker.debian.org/tracker/CVE-2023-52355 https://gitlab.com/libtiff/libtiff/-/issues/621 https://gitlab.com/libtiff/libtiff/-/merge_requests/553 https://nvd.nist.gov/vuln/detail/CVE-2023-52356 https://gitlab.com/libtiff/libtiff/-/issues/622 https://gitlab.com/libtiff/libtiff/-/merge_requests/546 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-21tiff: fix CVE-2023-6228Yogita Urade
CVE-2023-6228: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. References: https://nvd.nist.gov/vuln/detail/CVE-2023-6228 https://gitlab.com/libtiff/libtiff/-/issues/606 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-06tiff: Backport fixes for CVE-2023-6277Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-26tiff: upgrade 4.5.1 -> 4.6.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-20tiff: fix CVE-2023-41175Yogita Urade
libtiff: potential integer overflow in raw2tiff.c References: https://bugzilla.redhat.com/show_bug.cgi?id=2235264 https://security-tracker.debian.org/tracker/CVE-2023-41175 https://gitlab.com/libtiff/libtiff/-/issues/592 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-20tiff: fix CVE-2023-40745Yogita Urade
libtiff: integer overflow in tiffcp.c References: https://security-tracker.debian.org/tracker/CVE-2023-40745 https://gitlab.com/libtiff/libtiff/-/issues/591 https://bugzilla.redhat.com/show_bug.cgi?id=2235265 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-21cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-07-10tiff: upgrade to 4.5.1Ross Burton
Also remove old CVE_CHECK_IGNOREs which are no longer needed due to CPE updates. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-27tiff: backport a fix for CVE-2023-26965Natasha Bailey
Fixes a bug where a buffer was used after a potential reallocation. Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-01tiff: backport a fix for CVE-2023-2731Natasha Bailey
This patch fixes an issue in libtiff's LZWDecode function which could cause a null pointer dereference. Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-05-11tiff: Remove unused patch from tiffnikhil
Remove 0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch file from tiff as it was removed while upgrading tiff from 4.4.0 -> 4.5.0 Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-04-13tiff: Add fix for CVE-2022-4645Pawan Badganchi
Below patch fixes the CVE-2022-4645 as well. 0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch Link: https://nvd.nist.gov/vuln/detail/CVE-2022-4645 Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2023-02-24tiff: backport fix for CVE-2022-48281Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-01-31libtiff: add PACKAGECONFIG for libdeflate and zstdMarkus Volk
The main reason for this is an issue with latest libtiff update that causes gtk4-native configure to fail in finding libtiff (while it just builds fine for target). By comparing libtiff-4.pc for native and target it turned out, that it links for native with zstd and libdeflate. Probably because those libs were found on my host system. Adding PACKAGECONFIGS for the libs prevents us from taking them from the host. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-01-09tiff: Add packageconfig knob for webpKhem Raj
tiff-native otherwise falsely detects webp if its installed on build host. This ensures deterministic behavior regardless of host. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06tiff: update 4.4.0 -> 4.5.0Alexander Kanavin
Drop all CVE backports. License-Update: formatting Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-11-27tiff: Security fix for CVE-2022-3970Qiu, Zheng
This patch contains a fix for CVE-2022-3970 Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-3970 https://security-tracker.debian.org/tracker/CVE-2022-3970 Patch generated from : https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-10-28tiff: fix a typo for CVE-2022-2953.patchQiu, Zheng
The CVE number in the patch is a typo. CVE-2022-2053 is not related to libtiff. So fix it. Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-28tiff: fix a number of CVEsRoss Burton
Backport fixes from upstream for the following CVEs: - CVE-2022-3599 - CVE-2022-3597 - CVE-2022-3626 - CVE-2022-3627 - CVE-2022-3570 - CVE-2022-3598 Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-08tiff: backport fix for CVE-2022-2953Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-16tiff: Backport a patch for CVE-2022-34526Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-12tiff: backport the fix for CVE-2022-2056, CVE-2022-2057, and CVE-2022-2058Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07tiff: update 4.3.0 -> 4.4.0Alexander Kanavin
Drop all CVE backports. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28tiff: Add jbig PACKAGECONFIG and clarify CVE-2022-1210Richard Purdie
We never depended upon libjbig so this was never present. Add the PACKAGECONFIG to make this explict. CVE-2022-1210 is an issue in libjbig so we don't have a problem there, mark as such. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28tiff: mark CVE-2022-1622 and CVE-2022-1623 as invalidRoss Burton
These issues only affect libtiff post-4.3.0 but before 4.4.0, caused by 3079627e and fixed by b4e79bfa. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-12tiff: Add marker for CVE-2022-1056 being fixedRichard Purdie
As far as I can tell, the patches being applied also fix CVE-2022-1056 so mark as such. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-23tiff: backport CVE fixes:Ross Burton
Backport fixes for the following CVEs: - CVE-2022-0865 - CVE-2022-0891 - CVE-2022-0907 - CVE-2022-0908 - CVE-2022-0909 - CVE-2022-0924 Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21meta/scripts: Automated conversion of OE renamed variablesRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21tiff: Add backports for two CVEs from upstreamRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-26tiff: backport fix for CVE-2022-22844Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30Convert to new override syntaxRichard Purdie
This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-12tiff: Exclude CVE-2015-7313 from cve-checkRichard Purdie
Some fix upstream addresses the issue, it isn't clear which change this was. Our current version doesn't have issues with the test image though so we can exclude. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-04-23tiff: upgrade 4.2.0 -> 4.3.0wangmy
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-02recipes-multimedia: Add missing HOMEPAGE and DESCRIPTION for recipes.Meh Mbeh Ida Delphine
Fixes: [YOCTO #13471] Signed-off-by: Ida Delphine <idadelm@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-10tiff: upgrade 4.1.0 -> 4.2.0Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-06-04tiff: Extend for nativesdkChristian Eggers
Doxygen in meta-oe has recently been extended for nativesdk. Doxygen is often used together with mscgen which in turn depends indirectly on tiff (via gd library). Signed-off-by: Christian Eggers <ceggers@arri.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-21tiff: update to 4.1.0Alexander Kanavin
Drop backported patches. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-31libtiff: fix CVE-2019-17546Joe Slater
Apply unmodified patch from upstream. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-10-02tiff: fix CVE-2019-14973Trevor Gamblin
CVE reference: https://nvd.nist.gov/vuln/detail/CVE-2019-14973 Upstream merge: https://gitlab.com/libtiff/libtiff/commit/2218055c Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-07-16tiff: fix CVE-2019-7663Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16tiff: fix CVE-2019-6128Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16tiff: remove redundant patchRoss Burton
The patching to make the new libtool work (from 2008) is no longer needed. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-22tiff: update to 4.0.10Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-03libtiff: fix CVE-2017-17095Joe Slater
Backport fix from gitlab.com/libtiff/libtiff. nvd.nist.gov does not yet reference this patch. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26tiff: security fix CVE-2018-7456Joe Slater
NULL pointer use as described at nvd.nist.gov/vuln/detail/CVE-2018-7456. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26tiff: security fix CVE-2018-8905Joe Slater
Buffer overflow described at nvd.nits.gov/vuln/detail/CVE-2018-8905. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-18tiff: security fix CVE-2018-10963Joe Slater
Denial of service described at https://nvd.nist.gov/vuln/detail/CVE-2018-10963. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-25tiff: Security fixesYi Zhao
Fix CVE-2017-99935, CVE-2017-18013, CVE-2018-5784 References: https://nvd.nist.gov/vuln/detail/CVE-2017-9935 https://nvd.nist.gov/vuln/detail/CVE-2017-18013 https://nvd.nist.gov/vuln/detail/CVE-2018-5784 Patches from: CVE-2017-9935: https://gitlab.com/libtiff/libtiff/commit/3dd8f6a357981a4090f126ab9025056c938b6940 CVE-2017-18013: https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01 CVE-2018-5784: https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-15tiff: Fix multilib header conflict - tiffconf.hZhang Xiao
Header file conflict between 32-bit and 64-bit versions. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-28 17:28:44 +0000