This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3217403322816472160==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="9bzFxwlvfhKOYyTLuW0YGQS9d4HTsWV0N"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--9bzFxwlvfhKOYyTLuW0YGQS9d4HTsWV0N
Content-Type: multipart/mixed;
 boundary="zp3lCuT3XosrsNAN6mrntXRZcSPif5xTr";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <7c46623a-cc9c-403a-19fd-70102af07c13@canonical.com>
Subject: [USN-4755-1] LibTIFF vulnerabilities

--zp3lCuT3XosrsNAN6mrntXRZcSPif5xTr
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4755-1
February 25, 2021

tiff vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in LibTIFF.

Software Description:
- tiff: Tag Image File Format (TIFF) library

Details:

It was discovered that LibTIFF incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image, a remote attacker could crash the application, leading to a
denial of service, or possibly execute arbitrary code with user privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  libtiff-tools                   4.1.0+git191117-2ubuntu0.20.10.1
  libtiff5                        4.1.0+git191117-2ubuntu0.20.10.1

Ubuntu 20.04 LTS:
  libtiff-tools                   4.1.0+git191117-2ubuntu0.20.04.1
  libtiff5                        4.1.0+git191117-2ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  libtiff-tools                   4.0.9-5ubuntu0.4
  libtiff5                        4.0.9-5ubuntu0.4

Ubuntu 16.04 LTS:
  libtiff-tools                   4.0.6-1ubuntu0.8
  libtiff5                        4.0.6-1ubuntu0.8

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4755-1
  CVE-2020-35523, CVE-2020-35524

Package Information:
  https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.10.1
  https://launchpad.net/ubuntu/+source/tiff/4.1.0+git191117-2ubuntu0.20.04.1
  https://launchpad.net/ubuntu/+source/tiff/4.0.9-5ubuntu0.4
  https://launchpad.net/ubuntu/+source/tiff/4.0.6-1ubuntu0.8


--zp3lCuT3XosrsNAN6mrntXRZcSPif5xTr--

--9bzFxwlvfhKOYyTLuW0YGQS9d4HTsWV0N
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmA34jsACgkQZWnYVadE
vpNJEw//aXuziTg7OPDTwh+5s6F6JmiPg0704IZZwLzhqA8N+v9NPYkKMX6Ja1hd
KiQjQ64bDAvZUFZkj6zkQ0DWpanlzaj+b19Flag/4kDyQ4UC4GR1fv1RUupRzmuq
+bweWl3yPnH5S02hA8RJ5+GVH4o2o+m25JOjol7QszNIZbYtFt6T28emV36BucDp
GIkw6Oui5lwYZStzQL0uL70gGitP/JpuGGdfw/1cqX9GfMC7bZLeN8RvnKFs5cV+
uaGt7u45Z/YjqlhXaV73VPg4Ieq3CQc8CFp959IAK1J7C3P4wPWyXNj4JjhhAtkH
Kh5W7+4AHnr/ew64HDFv6RSsjoBxxumkRVXD6xMAyp91NSCIJTWaKu1wIeW/YZV9
U8S/x+ml+AjXaQbKTN2ykyLJjEFI35HNfjvSjXJvlmEhUQ66e9Z9BsLkU8lV5t9F
eZFAt1g8Fp7e6XRPKR6nujL0fuNdePzH3iYjIPaXbiBtH03jxw3v8g0Ffob2stjZ
y8uK+Ey3d4ks0At3Y9w/pNk8160L5X8LG5eAFiIRGTDiWVivXLQAjeozgqLrbsWr
Xy3rhezMpLXG4XKl81SyJQWybYixPuDqH8AlLuazrGsiI8c6+Bkj42xKtht0FeP9
NV3IU0gy+ldTPqmgI8DDb/9pnz3XbZm4Xxwszc/PjtyChHZY8uk=
=+HbH
-----END PGP SIGNATURE-----

--9bzFxwlvfhKOYyTLuW0YGQS9d4HTsWV0N--


--===============3217403322816472160==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============3217403322816472160==--