<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for tiff</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2023:0060-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2023-01-10T11:35:27Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2023-01-10T11:35:27Z</InitialReleaseDate>
    <CurrentReleaseDate>2023-01-10T11:35:27Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for tiff</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for tiff fixes the following issues:

- CVE-2022-3570: Fixed a potential crash in the tiffcrop utility (bsc#1205422).
- CVE-2022-3598: Fixed a potential crash in the tiffcrop utility (bsc#1204642).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Image SLES12-SP5-Azure-SAP-BYOS-2023-60,Image SLES12-SP5-Azure-SAP-On-Demand-2023-60,Image SLES12-SP5-EC2-SAP-BYOS-2023-60,Image SLES12-SP5-EC2-SAP-On-Demand-2023-60,Image SLES12-SP5-GCE-SAP-BYOS-2023-60,Image SLES12-SP5-GCE-SAP-On-Demand-2023-60,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2023-60,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2023-60,SUSE-2023-60,SUSE-SLE-SDK-12-SP5-2023-60,SUSE-SLE-SERVER-12-SP5-2023-60</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/</URL>
      <Description>Link for SUSE-SU-2023:0060-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2023-January/013447.html</URL>
      <Description>E-Mail link for SUSE-SU-2023:0060-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1204642</URL>
      <Description>SUSE Bug 1204642</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205422</URL>
      <Description>SUSE Bug 1205422</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-3570/</URL>
      <Description>SUSE CVE CVE-2022-3570 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-3598/</URL>
      <Description>SUSE CVE CVE-2022-3598 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Image SLES12-SP5-Azure-SAP-BYOS">
      <Branch Type="Product Name" Name="Image SLES12-SP5-Azure-SAP-BYOS">
        <FullProductName ProductID="Image SLES12-SP5-Azure-SAP-BYOS">Image SLES12-SP5-Azure-SAP-BYOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-Azure-SAP-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-Azure-SAP-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-Azure-SAP-On-Demand">Image SLES12-SP5-Azure-SAP-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-SAP-BYOS">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-SAP-BYOS">
        <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-BYOS">Image SLES12-SP5-EC2-SAP-BYOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-EC2-SAP-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-EC2-SAP-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-On-Demand">Image SLES12-SP5-EC2-SAP-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-GCE-SAP-BYOS">
      <Branch Type="Product Name" Name="Image SLES12-SP5-GCE-SAP-BYOS">
        <FullProductName ProductID="Image SLES12-SP5-GCE-SAP-BYOS">Image SLES12-SP5-GCE-SAP-BYOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-GCE-SAP-On-Demand">
      <Branch Type="Product Name" Name="Image SLES12-SP5-GCE-SAP-On-Demand">
        <FullProductName ProductID="Image SLES12-SP5-GCE-SAP-On-Demand">Image SLES12-SP5-GCE-SAP-On-Demand</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-SAP-Azure-LI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES12-SP5-SAP-Azure-LI-BYOS-Production">
        <FullProductName ProductID="Image SLES12-SP5-SAP-Azure-LI-BYOS-Production">Image SLES12-SP5-SAP-Azure-LI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production">
        <FullProductName ProductID="Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production">Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5" CPE="cpe:/o:suse:sles:12:sp5">SUSE Linux Enterprise Server 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5" CPE="cpe:/o:suse:sles_sap:12:sp5">SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libtiff5-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libtiff-devel-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff-devel-4.0.9-44.62.1">libtiff-devel-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libtiff-devel-32bit-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff-devel-32bit-4.0.9-44.62.1">libtiff-devel-32bit-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libtiff-devel-64bit-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff-devel-64bit-4.0.9-44.62.1">libtiff-devel-64bit-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libtiff5-32bit-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff5-32bit-4.0.9-44.62.1">libtiff5-32bit-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libtiff5-64bit-4.0.9-44.62.1">
      <FullProductName ProductID="libtiff5-64bit-4.0.9-44.62.1">libtiff5-64bit-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tiff-4.0.9-44.62.1">
      <FullProductName ProductID="tiff-4.0.9-44.62.1">tiff-4.0.9-44.62.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-Azure-SAP-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-Azure-SAP-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-EC2-SAP-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-GCE-SAP-BYOS">
      <FullProductName ProductID="Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-GCE-SAP-On-Demand">
      <FullProductName ProductID="Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-SAP-Azure-LI-BYOS-Production">
      <FullProductName ProductID="Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production">
      <FullProductName ProductID="Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-32bit-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.62.1">libtiff5-32bit-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="tiff-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.62.1">tiff-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.62.1">libtiff5-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff5-32bit-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.62.1">libtiff5-32bit-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="tiff-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.62.1">tiff-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libtiff-devel-4.0.9-44.62.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.62.1">libtiff-devel-4.0.9-44.62.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact</Note>
    </Notes>
    <CVE>CVE-2022-3570</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.62.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>5.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-3570.html</URL>
        <Description>CVE-2022-3570</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205422</URL>
        <Description>SUSE Bug 1205422</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.</Note>
    </Notes>
    <CVE>CVE-2022-3598</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES12-SP5-Azure-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-Azure-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-EC2-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-GCE-SAP-BYOS:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-GCE-SAP-On-Demand:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:libtiff5-32bit-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:tiff-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-32bit-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:libtiff5-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:tiff-4.0.9-44.62.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libtiff-devel-4.0.9-44.62.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2023/suse-su-20230060-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-3598.html</URL>
        <Description>CVE-2022-3598</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1204642</URL>
        <Description>SUSE Bug 1204642</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1206220</URL>
        <Description>SUSE Bug 1206220</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
