]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/commit
tiff: fix CVE-2024-13978
authorYogita Urade <yogita.urade@windriver.com>
Tue, 26 Aug 2025 10:48:32 +0000 (16:18 +0530)
committerSteve Sakoman <steve@sakoman.com>
Mon, 1 Sep 2025 15:24:33 +0000 (08:24 -0700)
commitf6ff692be6b08290845b6c6c27eaf5d676476464
treeb96625b7b45fcc8c36db9fc8ff3ac456b4c088e7
parent36cf6bb39df081b27306d27b20155995b73e1a01
tiff: fix CVE-2024-13978

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared
as problematic. Affected by this vulnerability is the function
t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps.
The manipulation leads to null pointer dereference. The attack needs to
be approached locally. The complexity of an attack is rather high. The
exploitation appears to be difficult. The patch is named
2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a
patch to fix this issue.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-13978

Upstream patch:
https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-multimedia/libtiff/tiff/CVE-2024-13978.patch [new file with mode: 0644]
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb