Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

Tasklist

Task Type Bug Report Category Packages: Extra Status Closed Assigned To Levente Polyak (anthraxx) Architecture All Severity High Priority Normal Reported Version Due in Version Undecided Due Date Undecided Percent Complete Votes 0 Private No

Details Description: The libtiff package is vulnerable to CVE-2022-1354 and CVE-2022-1355. The attached diff adds these two fixes as well as two segmentation fault fixes that are required for the second CVE diff to apply cleanly. Additional info: One of the diffs modifies a binary file, so the patch command will refuse to apply it. As a workaround, use "git apply" to apply them. Feel free to do something else if you have a better idea.    libtiff.diff (4.2 KiB)

Closed by  Antonio Rojas (arojas)
Sunday, 19 June 2022, 09:28 GMT
Reason for closing:  Fixed

Comment by mysta (mysta) - Monday, 23 May 2022, 16:33 GMT

Comment by mysta (mysta) - Saturday, 28 May 2022, 14:35 GMT