Return-Path: <SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org>
Received: from mailfep005.skynet.be ([10.35.4.252])
          by mailafep001-svc.mx.internal
          (InterMail vM.9.07.03.022 201-2473-138-3) with ESMTP
          id <20221104211222.JPTQ536.mailafep001-svc.mx.internal@mailfep005.skynet.be>
          for <chris.lindelaan@skynet.be>; Fri, 4 Nov 2022 22:12:22 +0100
Received: from el9758.bc ([10.27.1.13]) by mailfep005.skynet.be
          (InterMail vM.8.04.03.28.4 201-2389-100-182-103-20180124)
          with ESMTP
          id <20221104211222.XESX7202.mailfep005.skynet.be@el9758.bc>
          for <chris.lindelaan@skynet.be>; Fri, 4 Nov 2022 22:12:22 +0100
Received: from [31.186.226.176] ([31.186.226.176])
 by el9758.bc with ngmta
 id a7ce8add-17247e09cce0906f; Fri, 04 Nov 2022 22:12:22 +0100
Received-SPF: None (mx101.skynet.be: no sender authenticity
  information available from domain of
  tiff-bounces@lists.osgeo.org) identity=pra;
  client-ip=140.211.15.3; receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="tiff-bounces@lists.osgeo.org";
  x-conformance=sidf_compatible
Received-SPF: Pass (mx101.skynet.be: domain of
  SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org
  designates 140.211.15.3 as permitted sender)
  identity=mailfrom; client-ip=140.211.15.3;
  receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text="v=spf1 mx a:mail.osgeo.org a:lists.osgeo.org
  a:mail.osgeo.osuosl.org ip4:140.211.15.3 a:osgeo7.osgeo.org
  a:trac.osgeo.org a:dev.trac.osgeo.org
  a:secure.osgeo.osuosl.org ip4:140.211.15.57
  ip4:140.211.15.32 ip4:140.211.15.26 ip4:140.211.15.6"
Received-SPF: PermError (mx101.skynet.be: cannot correctly
  interpret sender authenticity information from domain of
  postmaster@lists.osgeo.org) identity=helo;
  client-ip=140.211.15.3; receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="postmaster@lists.osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text=""
Authentication-Results: mx101.skynet.be; spf=None smtp.pra=tiff-bounces@lists.osgeo.org; spf=Pass smtp.mailfrom=SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org; spf=PermError smtp.helo=postmaster@lists.osgeo.org; dkim=hardfail (body hash did not verify [final]) header.i=@mathworks.com; dkim=hardfail (body hash did not verify [final]) header.i=@mathworks.com; dmarc=fail (p=none dis=none) d=mathworks.com
IronPort-SDR: 63658035_4woaciTkKz5C9WP86hTdsL/m8RBPSd5ZZzS++ZFk3aQQGIn
 53hjdk1I9t8ikvESeywO9KCXTLOTJaKaA0F3NIg==
X-Proximus-RemoteIp: 140.211.15.3
X-Proximus-Mfrom: SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org
X-Proximus-Rcpto: chris.lindelaan@skynet.be
X-IPAS-Result: =?us-ascii?q?A0EkAQBXf2VjmAMP04xaHAEBAQEBAQcBARIBAQQEAQFAg?=
 =?us-ascii?q?U+BKjFSARgBZgKBAQIBCEyIGwOFL4gcAxaIQJYSNRgBAQIBAQEBAQcBAS4BC?=
 =?us-ascii?q?gsEAQEBAgSEfgKEeiAFAQQ0EwECAQIBAQEBAQMCAwEBAQEBAQMBAQEEAQEBA?=
 =?us-ascii?q?gEBAgQCAgEBAhABAQEBAQEBARQJGQUQDgMkhWgNgjUFAgMfBwtjSj4BAQEBA?=
 =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEBAQ8CDTQeNRIBAR0BAQEBAwEBAQ8bEwEBB?=
 =?us-ascii?q?AoeDAIDAQIGAQEBAQgRBAEBIwQBBwMBIwEKFAkIAQEEARIFAxqCWwGCbgMwA?=
 =?us-ascii?q?wECAgueIQGBCQGBPwKKHgEBAQF1gTSBAYIIAQEGBwOBNgEDBQkCQ5ZGDGmBX?=
 =?us-ascii?q?gMGgUCIcYNLF4M2ekOBSUR6XoI3MD6BBU6BDwEEggoJg1qCLo8AiEEDRB02C?=
 =?us-ascii?q?gMLbQMKSxYFWA4JHxYGDhcNBQYSAyBIJgVBDygvZyscGweBDCoJHxUDBAQDA?=
 =?us-ascii?q?gYTAyICDSkxFAQpEw0rByNxCQIDIhhNBQMDBCgsAwkgBBwHFgMOJDwHVxIoA?=
 =?us-ascii?q?QQDAhAiOgYDCQMCJFh/JiYFAw0XJQgFTgQIOgIFBlIGAQsCChEDEg8GJkcOS?=
 =?us-ascii?q?j45FgYneQ8OFANegW0GNZktgTAWgRN7IAIuCzEFCj8Foz4OjBSTXoNxgUyJf?=
 =?us-ascii?q?o0LiBcWg3iMU5hKlzAggiuKeJoLAgQCBAUCDgEBBoF5IwKBSAsHMxoIGxU7g?=
 =?us-ascii?q?mdPHA+OIINygX+DFYVKdTsCBwsBAQMJiQ6BbgEB?=
IronPort-PHdr: A9a23:v0ua0xSfXk74UVx+kbPOrqez7tpsoo6TAWYlg6HPa5pwe6iut67vI
 FbYra00ygOTAcOBsrkd17Oe8/i5HzBautDZ6DFKWacPfidNsd8RkQ0kDZzNImzAB9muURYHG
 t9fXkRu5XCxPBsdMs//Y1rPvi/6tmZKSV3wOgVvO+v6BJPZgdip2OCu4Z3TZBhDiCagbb9oI
 xi6swrcutMIjYd/Jao91xTErmZVcOhS2W9kOEifkhni6sq+5pJv7zhct/c8/MNcTKv2eLg1Q
 6ZFBzo8KWA148PrtRjHTQSR43YXT3sbnBlVDQXb9R/2Rpj+vDf0uep7wymaINb5TasoVjS47
 qdkUwHnhSEaPDMk6m7Xi8hwjKVGoBK9ohF03oDZbJ2JOPd4Y6jSc8kaRW5cVchPUSJPDJ63Y
 48WA+cBOOpVqZT2qVkTohukHQSiBP3hyiNGiHH106010esuHxze3AEiHdwCrXrZoMnpO6gMS
 uC416zIwSnfY/5MxTvx9JbEfxY8qv+MR7Jwds/RxFEgGQPBilWft4rlNC6R2OQKs2ib6fFgV
 eWpi2U6rAx+vDyvxsMyhYnPhIIY0VXE+j9lwIY1K9y4T1R7Yd2/EJdKqy6aMI52T9okTmp1t
 yk01qcItoSnfCgW1psn3RjfZuSafoaH5h/tW+icLzd2inxlZb+yiBm8/Eq9xuD9Vse501JHo
 ylLnNTMtX0BygLe58yIR/dh40utxziC2h7d5+1ZJ00/iKTVK5kkwrEql5oTt1zOHin3mEXtk
 K+abEok+u+26+j/bbXmp4OcN4tuhQ7lKKghhsu/AeE+PwMTXGab4fyx2KDs8EHlWrlGkOA6n
 rTDvJzHJckXvKC0DxdL3osi9xqyATKr3MkEkXYcLV9IfRyKg5TnNlzLLvD3E/KyjlGxnDpkw
 f3NI6fvDY/XLnfZlbfsZbZ95FBYyAo01d1f45NUCqodIPLoQEPxs8fYDhAnPAyz2ernD8991
 owGVWKOBK+WLr/SvEeV6u8gP+WAfpEZtCvgJ/Q/+vLjjWU1lFEFcamsx5QXaXS4Hvp8I0WeZ
 HrhmsoPH3sXsAYiVOHqiFKPXiJRaXuqUa8y6Sk2CIanDYfYWoCtm6aN3CCgHp1ZeG9GDUqAE
 XDyd4WLQ/oMdCOSIsFvkjAdTrehTJIh1ReyuwDk0LpqNe3U+jYXtZ3909h5/erTlQs99TBsC
 cSSyHmCT3tokWMQWz82wKd/rFRgxluby6h3n+RYFcBP5/NOSgo1KZ7cz/Z7C9DpQA7BetaJS
 FC7Tdq4BTE+VMg+w9kVbkZmGNWjjhbD0DS2A7MPjLOEGs98z6THwnKkJ9ph022Uk+4ljkI6W
 Y1ILmKrgeh47QeUAofIl0CQkeGtbbgd2yjWs3uCw2TdgUdDTQQlVKzEWWwYNFfXo9q8/E7bU
 rK1FZwjMxBd0oiFMaRHbZvul1oRX+rpOtnVfzesnXytDw2D3LKGYdnXfX4A1gXQAUQJiVUT4
 WqeLlp5QSOguH7FSjt1Gl/oJUT2/q57oXK/S0YyiAaSc0xm0aHy5h8bi6+hTegO1JIJsSsss
 WBxFVe5w9WEF9uOqU97cbxBbMghyFNGzn7C8QtmMZGnaad4iQkFbg51skjygghxEZhKisMwr
 XknnzZ1fOiE0V1PXzeZxozrfLrMJWT1uhe1ZOSejk3f3ti+/qYU9O9+rE7ssQbvEVAtpTEv6
 MRR2mbUso7XCAMPeZzrX0sx+gQ8q7yMMQcn4IaB+HloPK/8kDjC3ckuAqNxxxKkctFdGKaNC
 A/tFNcZHI6lL+l8yAvhVQ4NIO0HrP18BMihbfbTnfPD1JtIgmf/3ixOtZpm2weX9yMmF7Cbl
 51Q2fyc1xuKW3DmgVOoos37yshIMDQbAmqgzjLnH8haYaghGORDEjKrIsi6zdxlm8S1Ai4Ar
 Qf8VBsajZb3J0XPPgKmh10DsCZfoSmpgyy9nTJulDR7tKeH2D2L3+OwbwcNOGNAWDt5kF3uL
 IOo3dwTQEX6YwE1mUmg6F3hzqdW4aVzfWzeWlxBcCWzLm0wN8n4qr3Qf8kd45h6tCRSXaGib
 EqBS7n78R4b1i6mAWZE3zE8cWOhvZPlkhpmzX6MNHshp33fZcx22VLD9cTRF5szljsAATN1k
 T3GQ0S7bdivuM+Zj5PS9/y5BXisWJBJfC/gwJjSria16HdnBxayhKPW+JXtEV0Cjyzci/pqV
 Qr6iBTOX6Wsh4mmbs04WG44FRjG7eo9GrtGjtZrvJYCwHRG08bwnzINxE3UNtFw35DBb1g8Z
 wck7Z2N5CrF0lxaKHetn7ipeHWb5tRLRNO4fEkO1AY03f9TGPqV1ex6n3tHi3SC/S6KT9Ymx
 Cs5+f9LijZDqKYFgRMOyQ7EOa8ZMllKFiWxrAiXwNmjnqVvNWSNcpWS8lBPgIviE5Wogx1lH
 3/Ha5QdJAUh7M95G1L+4Hb+5bzlQ8L3CLBbnxfPzErSkbIOE44Dst80tXNGBlPdv20/lsMjp
 hlMgcTp9JjCKn9q+rq+GAIdLDDuescPrzHkl6pQl8eSjMi/W5R7HTMTW4H0CP+yCjUI4P7gO
 xfGEDQnqj+XGLaXGwiDoFlrtXPBAtiYOXCRLX0snr2KNzHFYGBaiRofZjgxmYQ1REiykcrmd
 ko9riga+guh8kMIgvlwYl23W2vcpQL9cHN8QYOHIk9MqklY+k6AAozR4O56RStU88So/VXdc
 TPCTx5FFScFX0WeDFnlN72/99TateOfA6X6Z6KWPeXT9rIGFsLMw5Wp3+OOnh6JJpzXZz95D
 Ow911YFV30qU9/BlWApTCoa3znIc9bdvA21rzF2oM76+vP2Xgni/qOLCqBOKpNo4B+7huGEL
 eHDzD1hJ2Ng34gXjWTN1KBZ2VcTjy90cDz4Ko477XvNEKnwz/R6WhoacD9ocsxT4K87mA5XN
 pvHi937k7R/k/g+BkxtUkful8bvYtYFcCmmLF2SPEuRMZmcPzrRi9ryfbv6SbBUi7BMsAasv
 D+AD0L5FjCCjCXyERe0PuxLyiaBM08WtIK8d0NtAHLvQtvnblX7Oth7nHU2yKY0zn/LOSYaN
 iQ0bU5Xr7OBpRBWg/N2H1kApnpoJOWJgWCYusHdI4oWrvxxAT8ynOVfszw2yLpQuSFNXvB7k
 SrW5p5kpF232umG0TovXBtC4jBMmMqVsF9jN7SRxZdBX3/AyVNF7WiZBxkQ4dowItjmp6BPz
 cLMj+T4LzIRu97R9NEXUsbdKcbPcGJ0Nx3vFXbYDRBQSzmtOCCXixlYme2S6XqPrYN8oZ/p8
 HYXYplcUlF9VvYKUxw8WscBMZF6QnUunOzTislA/ne4oBTLDMxHopDKUO6TCvTzOVP7xfFFY
 RUP27bxMYUUMMXyxUVjblBwmImCFVDXWJhBpShobwl8p0sokjA2Umw91QfvbR6r63IIPfq1h
 QItzAxlbukqsjD27BZ/J1bHojcxjFhkgc/s0lXzOHb6KKa9W50TCjKh7hRpdMmiGkAsMEvpz
 gR+OTzJRqxcle5lZTkz0UnHuopJFOIaR6AXBX1YjfyRefgs1kxR7yu9wkoSr9D/MsM3lFchU
 cv3gidE2hl/d5gyPqPdI+xO1FcFmqOAsGqi0f03ywIFD0EW/26VPikStwZbU9tubzrt5eFq5
 QGYznFfeWYCEvAtv/Rh+1gVP+Wb0zmm1KVMJ0f3MPaQZfD82SCIhYuDRVU+0VkNnk9O8O1t0
 MstREGTUlgm0LqbExlh2dPqEQhOdIIS8WiKJX/Iqubcx59peY+wRKjkSuqHtaBchUzBfk5hJ
 L43tpEBQpKMhRr1eMPmN6IejxI26wnsYlKfA6FVeRyF1T0Avse0wYRf2pJSKzZbBn9yVEf/r
 rravQ4lhvOfUcx+OytCGNFdbzRvBYvh0ydC92xNFjy2zv4UxECZ4jnwqz6RaVu0J9tvafGIZ
 A99XdS/+DEx6a+z2hbc9pTTIX2/NMw344OXr7lD/tDeVrUPHtwf+w/GloJVRmKnSTvKAYftf
 t7raJgqYMCyAHvpNz73wz8zUcr1O86ga6aShgS9D71ui9HO3GwoFZrmO2QaGgxsvKcE/61xY
 ksEeZVufR/muUE0MLG5KwqD+tK1TGuqbzxMQLMMqIfyL6wS1CcqYuKgnTEbdKpimunr+m5YH
 7xfihDF2e3lYJJRXC+1HWZSLhnOqyR8nW98MO0/2c842xzFth8bKT/BJ4kLICRU+to7A12VO
 3B/DGE1EkSdgYT06Qmpx7kO/iFZkoUcwahfvXP5pJOafCO0Vfnht8DOqyR5J4tDweU5Icn5L
 8CBrp+bgjHPUMyarFieSCDjX/9K0tECJStZRL9Pgm4oPooBo4UJ4Bg1V9wiPPpIE6Yhofatc
 zUBb2ZaxH0cXoKEmjsZjeq7nbzBixCLdNIlKhNMsY0e0IJBC2gsO3pY/fLlDM3fxWifRWUMf
 0EU9gtB40QHjIAVHKit6djUVpZHjTlNrP9zFCzRGdFhpVf2VCeKm1HzDvK6nOGumwVIw5eOm
 pESCgVyAlVHyqBRjUQlL/dwMLQXpYqMtSWHPULi4DC0lLPgfgAIj5SJMQCnaeiN/WvkDn9Fp
 SVSH9YWjiiCU89I2wthNPRy+A0Ketn/PB+joWZ6j4VxQ+vhCZjtnQ986y9bAXngezZYI9lrq
 lf6QidiedjrrYW8Y8wUWWxB/pCB7V1Uwg1mOii/zoYUIMZX+DMHQDxexFfV9Nq0VMBZwdV7E
 9cXL9Fztm21Eb5YOJWXv3w9u6D+gn7f9TcmtV6mxTK1U6GiSOcR82obEwQvb2OQzytnR/Mr6
 XvX+0vRv0pc++ZAGqPJil5+rTE7GYpBR35I2X2jM1VvXSxGvuFde8G3O4RXR/g/YwPqOgRrT
 KJ+mRbQpActwDGiMGRouwBX+j7QRVwxRXBN2/H2miwYp93hMzJJLvAAJTgncSrBLBqW3C5Nu
 xMKIXpQYMhMAopO2+RA8N5Q/9HeUgCrMi4IW1plLA1tzftRmwtJt1ieci3GJQ2zevvI9Bptc
 o3CyazhZOS85wpBho795aog8L4fQnS9hQC3adTftJPn8NqRuUaJMqDiPKfvBB2JBCiJhhe2i
 7A+CpDM9CWGKwtXJa5xzn88aITgA2rGblxWYrgWLE1BWeVmeM1L96pEMtR8dv9DqsoPTlqXA
 wniE4u1oLxaI0bPEH6UR81u2uukro/Uq7vHRrq5DiRt73LGWL5seJBh5jT8XbDw3t0AkqIT8
 vNs7V9hD1/dPC2G6tP7KVFTjPQ=
IronPort-Data: A9a23:2zdfcKM3pNkQtVfvrR3jnsFynXyQoLVcMsEvi/4bfWQNrUor1GRSn
 2EbUD2Ca/7YYWD3ftl3bt7g8hhS6sfUztY1TAZtqno1EnhH9JudD4iVJ0n9NX2ZdZ2aFktps
 5QQO9PNcJlkH3TRjynxDrWw9nMUOYNk51bfILeaZX8uH1Y6IMsFoUg+8wLsqtcw2bBVOyvU5
 ZWo5ZS31GaNg1ZcKngT57+ItCRhtfHzvCJwllElbJinhneH/5UuJM9ZdP/Zw0fQGNEORLfjH
 7qbl9lVw0uAl/sTIoP6+lrEWhBSKlLiFVDmomZbXaGkni9DqkQaukrsHKNBAav/o2zhc+FZk
 L2hh7TpIesaFvekdNAmbvVtO30W0ZtuoeGYfifl6JL7I3ruKBMAy902ZK0/0BZxFuxfWQmi/
 tRBQNwBg4zqa0tbD9tXR8E17vnPIvUHM6sZs2pt6Q7mCs05esnIXqySu/l11zs/05Um8fb2P
 6L1aBJrbQ/ceFtIIVgaD9Q5hujAanvXKmEA7gjM/Oxuvi6IpOBy+OCF3N79QeaxHZBVwk248
 znrqmD4GQ0BctuExjeCtHW2ibrTnC31HYgVCbuz++VCh0acy2tVDwcZPbe+iaTn2xbnBYkAd
 iT4/AJznIcP9XSCYODnASHkmFTepREOdvhfRrhSBAalkfaEvlfHWgDoVAVpY9w8tdRwQT0s2
 lKNltrvLSdsobuYVTSX+9+pQSiaPjMaIGhcIygfQgYCpd74vYYoilTIVNkL/LOJYsPdHzjrz
 hS1ky8FmI5KhtMCj/ud0FvLjGf5znTWdTId6gLSV2Ojywp2Yo+5eoClgWTmAeZ8wJWxEgXf4
 SVf8ySKxKVXV8rUz3HVKAkYNOjxv5643CvgbUmD9nXL3x2p8XelbOi8Cxkvexwza67oldIPC
 XI/VCtW/5BeOyXsarR4boX3DN83yrPkU9P/WZg4j+aigLAuLmdrHwk0PSZ8OlwBdmBwz8nT3
 r/HLa6R4Y4yU/gP8dZPb751PUUX7i4/33jPYpvw0g6q17GTDFbMF+labQvQMLtit/3fyOkwz
 zq5H5bao/m4eLCjChQ7DaZKdzjm0FBiWsyu+5Q/mhCre1s7cI3eNxMh6eh9K9E0wfg9ehbg+
 HyhRUhCyxLxgmePJAmXYXl/abTpFZ95oTohMDchNEyj2zAiZ86o9qoQcJ1fQFXU3LIL8BKAd
 NFcI5/oKq0WElzvom1NBbGg8tEKXEn11GqmYXD5CBBhJMQIb1KSpbfZkv7HqXNm4tyf75Vu+
 tVNF2rzHPI+euiVJJ+POK3+lAvq4yl1dSAbdxKgH+S/sX7EreBCAyn4kv8oJNsPMlPIwT7y6
 upcKU5wSTDl+tNsqIv6luqfop23EuBzOENfEiOJpfy1LCTWtC7ri4NJTO/CL3iXWXLW6ZeSQ
 7xf78j9F/kbw3dMkY53SIhwwYwEutDAmr59zyZfJkvtUWiFML1bD0O97ZF9jZEVnr59kimqa
 32L4ehfaOmoOtu6MVs/JzgFT+Wk1NMIqwno6vhvcVTzvwpqzeDWTWRTIBi+pyhPJ5RlMI4e4
 LkAuexHzyedmxYVItK9oSQMzFu1L1sESP8BtKgBJY3alToQ1VBJZKLDBh/M4J2gb8tGNm8oK
 GS2gJXuqqt9xE3QVWgaDlnIgPRggKoRtCBwzFMtI0qDnvzHjKQV2DxT6TEGcRRH/C5Y0u5cO
 nlZCGMtHP+gpwxXvclkW3ygPypjBxfDo0z49AYvpV3jFkKtUjTAEX05NeOz53smymN7fAYK2
 JGDyW3gbyTmQ9Gp4As2RnxeiqLCSf5fy1T8vf6JTuW/IokCQDv6g6WRS3IChDn5DOgQ2kDWh
 +lY09xhSK/8NCQ/p783K6yH3+82TiK7dHFIGtNn3aIWHFPzfCO59iiOJnuQJOJMBa3u2m2pB
 /N+IvlgU0yF6x+PiTQAF4sgHqRRnsN11OEde7juG3EKg4GfohVtrpjU0Cr0300vfPlDjuc/L
 dn3Ww+ZM2nNm0ZRpXDBnPNENkW8f9MAQg/2h8Kx0ecREqM8oPNeSl4z3pS0rkeqHlNepTzMh
 zz6ZojS0+BG4qZvldG1Eqx8WiOFGemqX+GMqA2Oo9BCaO3UCvj3tiQXlAjDHx9XNr4vSdhIh
 eyzkNro7njk4pcycU7kwqekKYcYwP6MetdpD5/LEkR7nA+petPd3B8YymXpdb1LiIx84+ekd
 SuZaeyxV8Uca/EFz2wIdSMEHxIXGvnpZaLrpAeWjfeFOj4C2yPpcfKl8n7IazlAVykqYpfRN
 C79i8yM1Pt58rteIQAiPO53JaN4LHvIe7oUR/eouRa2VmCX006/4J38nh8e2BT3I3ijEveix
 6naRxL7JS+AiIuRwP5364VN7wAqVlBjiuwNf2UYyd58qxa+KEUkde09E5E3Oqt4oxzI9qPTR
 W/yNTM5KCDHQz57Xw32443jUiehF+U+AIrFCQJzzXyESRWdJd2mMON6+zZC8kVGXGLp7NuaJ
 OE0/lzyORmMwa9Ve9sD28zjkcVan8nk+nYux3n8stfTBk8eCIoa1XY6EwtqUzfGIv73l07KB
 DYUQHBcSxqBW2r0QNRSIUBLPBRIrQH+7i4JaB2Xy431oLSrz+xnydz+Ndrs07YFUt84Gb4WS
 V7zREqP+2qzyFVKnYcI4vUH2bRVD9CPFeiEdJ7TfxUYxfyM2z52LvE8kjoqZ+B83gxmSnf2t
 CSmulo6D2S7cHFh4qWck1g1ysggQ0A3Lm/7iSDkrmX7ij0/9d/SfiaqwC/dKZ3dr6vCvV1Sc
 AwNbXS+8kGniz/5mQZQ7vgrhESLIcU0J0n2VioFSpDTkBD1RlRNS5Fn8UUxjOxK/FN+m457S
 ae20vcGwryBYB+h5Q7eoYomUuBVlItZQgUnoJ31zS1vDeq1hd/acc7mC7OUTTQyoBBRWHYf2
 Zffb1bOVBzdtAJQehdHuMThbYN2xZrl9rA/6XQ5Vdt7vJ3F2LchupeI2yucUyUIaregDKGtN
 F7w59S/GjYJeWDdUNBa2AsEw96J6NBQ+VjErWq6El2ujoys2XxiGPlJwa8ah/yad2VpYTob0
 kaiUMLJiY7W4XyksB/J5HK2tKUOFAe0zq0ySxHTG3fJJD0dn711ipGv4++QlC0MWJxVRJd/z
 U5kH0XI5cfg0mIfQCKwdxoSYw+RQnXaTOSnItsuRd+npdLuIZIpJ5YXslZWUa1R/GUJqsxhL
 TiuMqizzd5JeYdZYJWEqUn4VRlZ4Fkg9P9UuZHPa6Y83pHF4F2oxazeAOTRi5fgORnUn370x
 grSo7Y2gWnLjrPd03cFrS29Uu/4wwmW249cDSKR1QxjwyfXKfh7DGrWSv1gudCQQzAAzQgiP
 0nRT4DE+rgnK9f3X3PTCaDykgvcVXErp+1eMnK7a38+DrpknrTuGlkH5VosISUyMR98EP17/
 ms=
IronPort-HdrOrdr: A9a23:i3iyJajD+O7Q03NlE2zHKLn7PHBQX5d23DAbv31ZSRFFG/Fwz/
 re58jztSWftN9jYgBkpTngAtjefZq4z/JICOYqTNCftTfdyTWVxe1ZnOjfKnjbalXDHsA079
 Y8T0FVMqypMbBC5fyKujVR+b4bsYW6GdmT9LzjJhRWPHdXgsNbnmFE412gYxRLrWB9bPJTef
 X8hvav5QDQAEj/Qf7LV0XtNNKz4+Ej4aiWBSLucCRXjTVm4wnYioIT0nCjr1Aju54l+9kf2F
 mAtza8yrSosvm9xBOZ/XTU9Y5qlNzozcYGLNCQi+AOQw+cwjqAVcBEYfmvrTo1qOag5BIBi9
 /XuSotOMx19jf4Yny1mx3wwAPtuQxeoEMKiGXoy0cLk/aJCA7SOPAxyr6xtSGppXbIiesMnZ
 6jGVjp9qa/Qymw3BgVrOK4LS2C3nDE3EbLHoYo/jpiuQx0Us4SkWTKl3klU6voWhiKobwPAa
 1gCtrR6+1Rdk7fZ3fFvnN3yNjpRXgrGAyaK3Jyz/B9/gIm70yR9XFotvA3jzMF7tYwWpNE7+
 PLPuBhk6xPVNYfaeZ4CP0aScW6B2TRSVaUWVjiVmjPBeUCITbAupT36LI66KWjf4EJ1oI7nN
 DEXElDvWA/dkryAYmF3YFN8BrKXGKhNA6dvv129tx8oPnxVbDrOSqMRBQnlNahuewWBonBV/
 O6KPttco/exKvVaPd0NiHFKudvwCMlIbEoU/4AKi2znv4=
X-IronPort-Anti-Spam-Filtered: true
X-MGA-submission: =?us-ascii?q?MDFEXbVhJuuPT5A9yrrmaaexMTXTkg5lyrm+ND?=
 =?us-ascii?q?MTgEAM/QAqDBA23xwPyVhUXMGpYni3/G/CFsLB7/BQIbEf8kNctOtz9e?=
 =?us-ascii?q?nVXthMIA+vYL1UOEsSG2biJ8JwEg87i8GxbMo=3D?=
Received: from osgeo6.osgeo.osuosl.org (HELO lists.osgeo.org) ([140.211.15.3])
  by mx101.skynet.be with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Nov 2022 22:12:19 +0100
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id C2F8D614216C;
	Fri,  4 Nov 2022 14:12:11 -0700 (PDT)
Received: from us-smtp-delivery-120.mimecast.com
 (us-smtp-delivery-120.mimecast.com [170.10.129.120])
 by lists.osgeo.org (Postfix) with ESMTPS id 054D9614682E
 for <tiff@lists.osgeo.org>; Fri,  4 Nov 2022 14:12:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mathworks.com;
 s=mimecast20180117; t=1667596328;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:mime-version:mime-version:content-type:content-type:
 in-reply-to:in-reply-to:references:references;
 bh=P6kO4KhhGZLjZUD/8Et7G7NO8y/RnH/hRPt53Pozqd4=;
 b=BOolCnZWkJYJQGF+0lJHbyQnmL0R8FhnLwBKbjvBpfLaZWqx5iQ8Vj8ZAFR8D3FF32tLXl
 1C/dQqKoC1SwcGxzCa5StwGauZhP9jJkEJNrYu3+wLBItQ/aVykWQB9jbnChZXcegUiSsO
 Ab375zv23StZLMVX1IWYHjxr5EpCmJ4=
Received: from na01-obe.outbound.protection.outlook.com
 (mail-eastusazlp17010001.outbound.protection.outlook.com [40.93.11.1]) by
 relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 us-mta-659-67Ju7BLHNx2WGVMXLxFn5A-1; Fri, 04 Nov 2022 17:12:06 -0400
X-MC-Unique: 67Ju7BLHNx2WGVMXLxFn5A-1
Received: from CO1PR05MB8315.namprd05.prod.outlook.com (2603:10b6:303:fe::14)
 by BN7PR05MB5794.namprd05.prod.outlook.com (2603:10b6:408:37::24)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5791.22; Fri, 4 Nov
 2022 21:12:03 +0000
Received: from CO1PR05MB8315.namprd05.prod.outlook.com
 ([fe80::95f2:dee7:c8a6:5cc7]) by CO1PR05MB8315.namprd05.prod.outlook.com
 ([fe80::95f2:dee7:c8a6:5cc7%6]) with mapi id 15.20.5791.022; Fri, 4 Nov 2022
 21:12:03 +0000
From: Ellen Johnson <ellenj@mathworks.com>
To: "tiff@lists.osgeo.org" <tiff@lists.osgeo.org>, Sulau <sulau@freenet.de>
Thread-Topic: [Tiff] clarification on the fix status for new CVE-2022-3570?
Thread-Index: AdjnyqDXXcxh9bPHTz+3oHMw+z0J8wBsf9UAAAH19LABwtae4A==
Date: Fri, 4 Nov 2022 21:12:03 +0000
Message-ID: <CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9@CO1PR05MB8315.namprd05.prod.outlook.com>
References: <CO1PR05MB8315921C39C2C0E205E48E62D32E9@CO1PR05MB8315.namprd05.prod.outlook.com>
 <!&!AAAAAAAAAAAYAAAAAAAAAEUNXr1cc6FEs82BI4LfFJfCgAAAEAAAAC39sxgi9ptAi/mVqJTZA+UBAAAAAA==@freenet.de>
 <CO1PR05MB8315397904224AA0E44FFF84D3309@CO1PR05MB8315.namprd05.prod.outlook.com>
In-Reply-To: <CO1PR05MB8315397904224AA0E44FFF84D3309@CO1PR05MB8315.namprd05.prod.outlook.com>
Accept-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CO1PR05MB8315:EE_|BN7PR05MB5794:EE_
x-ms-office365-filtering-correlation-id: 5e4a40c3-6b20-4555-2aba-08dabea938c9
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0
x-microsoft-antispam-message-info:  
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
 IPV:NLI; SFV:NSPM; H:CO1PR05MB8315.namprd05.prod.outlook.com; PTR:; CAT:NONE;
 SFS:(13230022)(4636009)(376002)(396003)(39850400004)(346002)(366004)(136003)(451199015)(110136005)(8676002)(66476007)(66446008)(7696005)(966005)(66556008)(71200400001)(76116006)(6506007)(478600001)(53546011)(52536014)(41300700001)(26005)(5660300002)(186003)(8936002)(2906002)(9686003)(83380400001)(64756008)(86362001)(66946007)(316002)(38100700002)(38070700005)(55016003)(166002)(122000001)(33656002);
 DIR:OUT; SFP:1101
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?reRBDP9dKBkb8tq3+quaXYSowjvtNJrellkSOhivOTXZQ1Z41cn/7fyQnhQO?=
 =?us-ascii?Q?0fP/Qf1JVfUHqS2UnzN7i58dF41pxRTUwtygtWoZC4t6HwpUddfYpsiDMWFP?=
 =?us-ascii?Q?/bXMU5n1jeY78UcqldagTfFxtlE4FwoLk9YYQm0CD6fJ7LrPH4XItttpoFCp?=
 =?us-ascii?Q?Zxi1VEPQQnJnMNNRYk6qnnMNihOlyC7anT7ovFIdzQy6B73X3pYwLI9UQWlh?=
 =?us-ascii?Q?m1UWW2rjaCSsF1pSy/Vu4M/bd6RYhXVA6J5Nugw+JAsSc4RCLjiVoFnh2caW?=
 =?us-ascii?Q?VPC5bJ01vwAn5SQpP59DQ/+Z4ggNYpXrfTW9Qh2C4Pl0/DD7ekW8P0a+DuJH?=
 =?us-ascii?Q?aroacnpGD//JRXHaJPuZyFtQ7GJUbmMxplPp50EKCF2ez66omPtHNl/iNJ1U?=
 =?us-ascii?Q?WYFH9o4HemEg29hMxiw3DBBO07NEDnz/gByoc1TnlXetlzBFu0/GYmqhi2KX?=
 =?us-ascii?Q?gYECITeS88vHlQQscq05FgXFaH8whsEOO6cNllnqk+ZCWhFmG7MarVX4Uc+Y?=
 =?us-ascii?Q?3bXnBbmWk4jPgVvBm5fqthjXKn1av2rwCejl9fqJcX7qmFbGku740sb2+qWG?=
 =?us-ascii?Q?8fzQrz9rtVT9yAEkmWTJh8A4i5KJ2HJXh2udvXaSWRTybHjQx8bWO0qjbAa8?=
 =?us-ascii?Q?dt55XAOwAOVa4KGo8ZWW8cxdauIeDLoNXM48aVRTnsOMeDhC5UNAV3zR/RLo?=
 =?us-ascii?Q?Ate7Q2zTO5/JJDTj/xrd5ptKK2IuY5hUbgsO74Af/MiFH6we120GZ2dTMvvz?=
 =?us-ascii?Q?AEkqxzfMJdFeF46q1426hf6MmnLCiuN9yvTOWR++6nztsxNz0RPY5OM+C/HZ?=
 =?us-ascii?Q?AGexJiVnObD3r53+/TrhxUrH5+CeQlIlc0xxOjQapxzRogXWXwPu/4kqoP8e?=
 =?us-ascii?Q?GRKFh1Vg+1OkLopiuMPP1MFsX18u7/31ZM41cAZRXw+QnT6dlLtFDvd8ijLy?=
 =?us-ascii?Q?IW+ukUZTg0cgCuViOzLOeCy9ist2zILH1TKe3Rv+Lm+RUJndcPaqpjoUr7wv?=
 =?us-ascii?Q?F5ZN2TlLE85xaVDyXLEckvw4jbDd8yjMcHRyWKKGfRlwWakc7O3b0nTHdDPW?=
 =?us-ascii?Q?vZYHc+olqdgxS9G1CuDcmu1inqpiLglZU3cs2dXHaTj12Gr+giYT5T5oUggt?=
 =?us-ascii?Q?4DsyBXZZUzaXAVgmjTRb096hX6k9jNeP0LwbzijB08FU+jkLyHyA311BLKCY?=
 =?us-ascii?Q?e8vsXy9bb7W/KUsdDD8auu8rnyQ40xTgM+Lxw0japYb6wf+3vdI1OybIOb8J?=
 =?us-ascii?Q?aP5HcjAUiMH0swiMA8xltUhRu9m/rNVFpRzzQiI5tn/epSDm61ZVYJEv5HOg?=
 =?us-ascii?Q?j/WvST3W35JGF6t2aAoKSWTrT85wpi6TeWuSWz80WPq9VV6YdJZqSVS4KPvp?=
 =?us-ascii?Q?Txs5bqunY8IBKWJ0yb/HiOJKCnIpxCiJ7NCfny408lDeSdggtp5VQCGaMLo2?=
 =?us-ascii?Q?hPu8FjnbMLf3Xfv3GqIfnw8CBnBEk23/X0NHAHPDCdu065R30Ud5ONt2b4bR?=
 =?us-ascii?Q?IGgiMu4UEv9c6wErf+oGC4o53Sdt6Q2NerZiXnWAGlmhlj0Zbzuu1W3pKUCN?=
 =?us-ascii?Q?e+J/sCT2TXXK6BalMiwcAnS4YS/mmohm8YGyFbu4?=
MIME-Version: 1.0
X-OriginatorOrg: mathworks.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CO1PR05MB8315.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5e4a40c3-6b20-4555-2aba-08dabea938c9
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2022 21:12:03.7179 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 99dd3a11-4348-4468-9bdd-e5072b1dc1e6
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: tCxBINfF2XkieS+xYoj7rTTk5KJw5Qv3y0a1lLsNxi9GEp9m8IdY/LrVHCC1UtxeEYePMNtg8rDfl5qF4Az22g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR05MB5794
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: mathworks.com
Content-Language: en-US
Subject: Re: [Tiff] clarification on the fix status for new CVE-2022-3570?
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============5706773825970709980=="
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>
X-VadeSecure-Score: -5
X-VadeSecure-Verdict: clean
X-VadeSecure-Cause: gggruggvucftvghtrhhoucdtuddrgedvgedrvddugddugeefucetufdote
 ggodetrfdotffvucfrrhhofhhilhgvmecurfftqfgikffofgfunecuuegrihhlohhuthemuceftdd
 unecufghrlhcuvffnffculddqhedmnecujfgurhephffvthffkfhfjgggufhpjefjudeftdgtvghs
 sehmtddtredttddvnecuhfhrohhmpefglhhlvghnucflohhhnhhsohhnuceovghllhgvnhhjsehmr
 ghthhifohhrkhhsrdgtohhmqeenucggtffrrghtthgvrhhnpeeugfelgfefhfffhfeugefgjeduie
 fhkeelkeffheekudevleegtdduvdefveefudenucffohhmrghinhepnhhishhtrdhgohhvpdhgihh
 tlhgrsgdrtghomhenucfkphepudegtddrvdduuddrudehrdefpddviedtfeemuddtsgeimeeftdef
 mehfvgemmedugeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedugedtr
 ddvuddurdduhedrfedpmhgrihhlfhhrohhmpefutffutdephhegtgfjpeefgfeplhhishhtshdroh
 hsghgvohdrohhrghepthhifhhfqdgsohhunhgtvghssehoshhgvghordhorhhgpdhnsggprhgtphh
 tthhopedupdhrtghpthhtoheptghhrhhishdrlhhinhguvghlrggrnhesshhkhihnvghtrdgsvgdp
 mhhouggvpehsmhhtph

--===============5706773825970709980==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9CO1PR05MB8315namp_"

--_000_CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9CO1PR05MB8315namp_
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

Hi Su and libtiff folks,
  We just received a slew of 16 libtiff CVEs reported to us by a large cust=
omer - this is in addition to CVE-2022-3570 I previously wrote about.  I se=
e most of these CVEs are fixed in the libtiff master branch but not yet in =
an official release.
  I have two questions:

  1.  Can anyone provide an update on an estimated release timeframe for a =
libtiff version (presumably 4.5.0) containing all the CVE fixes that have b=
een successfully integrated into libtiff master branch since release of 4.4=
.0?
  2.  For newly reported CVE-2022-34266 in https://nvd.nist.gov/vuln/detail=
/CVE-2022-34266:  I'm confused about this one.  It states there's a vulnera=
tbility in TIFFFetchStripThing in tif_dirread.c in the libtiff-4.0.3-35.amz=
n2.0.1 package for LibTIFF on Amazon Linux 2, and states it's a different v=
ulnerability than CVE-2022-0562.  The NVD report for CVE-2022-34266 doesn't=
 contain any links to a libtiff GitLab issue describing the vulnerability, =
but I do see that the libtiff fix for CVE-2022-0562 was released in 4.4.0. =
 Can you please let me know if CVE-2022-34266 is a new vulnerability that's=
 different from CVE-2022-0562 as stated in the NVD CVE report?
  Thank you,
    ellen

From: Ellen Johnson
Sent: Wednesday, October 26, 2022 5:50 PM
To: Sulau <sulau@freenet.de>; tiff@lists.osgeo.org
Subject: RE: [Tiff] clarification on the fix status for new CVE-2022-3570?

Hi Su,
  Thank you so much for clarifying.
  Do you have an estimate on the timeframe for release of 4.5.0?
  Thanks,
     ellen

From: Sulau <sulau@freenet.de<mailto:sulau@freenet.de>>
Sent: Wednesday, October 26, 2022 4:51 PM
To: tiff@lists.osgeo.org<mailto:tiff@lists.osgeo.org>
Cc: Ellen Johnson <ellenj@mathworks.com<mailto:ellenj@mathworks.com>>
Subject: AW: [Tiff] clarification on the fix status for new CVE-2022-3570?

Hi Ellen,

issues 381 and 386 are fixed and related MR is merged into the master branc=
h one week ago. So they will probably be released with next version 4.5.0

Regards,
Su

Von: Tiff [mailto:tiff-bounces@lists.osgeo.org] Im Auftrag von Ellen Johnso=
n
Gesendet: Montag, 24. Oktober 2022 19:05
An: tiff@lists.osgeo.org<mailto:tiff@lists.osgeo.org>
Betreff: [Tiff] clarification on the fix status for new CVE-2022-3570?

Hi libtiff developers,

  I'm confused about the new CVE reported in libtiff >=3D 4.4.0 related to =
the previous CVEs in tiffcrop.c.  There's a lot of comments in the GitLab i=
ssues and I'm trying to detangle whether this is fixed in 4.4.0, or in the =
master branch waiting to be released into a new libtiff version, or still o=
pen and not yet merged into any branch.
    NVD link:  https://nvd.nist.gov/vuln/detail/CVE-2022-3570<https://nvd.n=
ist.gov/vuln/detail/CVE-2022-3570>
    Related libtiff GitLab issue:  https://gitlab.com/gitlab-org/cves/-/iss=
ues/479<https://gitlab.com/gitlab-org/cves/-/issues/479>

  From the GitLab posts and merge requests, it looks like it's related to t=
he previous CVEs fixed in https://gitlab.com/libtiff/libtiff/-/merge_reques=
ts/382<https://gitlab.com/libtiff/libtiff/-/merge_requests/382>.
  In these two GitLab issues, the CVE reporter is saying they are still ope=
n issues in 4.4.0:
    https://gitlab.com/libtiff/libtiff/-/issues/381<https://gitlab.com/libt=
iff/libtiff/-/issues/381>
    https://gitlab.com/libtiff/libtiff/-/issues/386<https://gitlab.com/libt=
iff/libtiff/-/issues/386>

  Can you please advise on the fix status for https://nvd.nist.gov/vuln/det=
ail/CVE-2022-3570<https://nvd.nist.gov/vuln/detail/CVE-2022-3570>?
  Thank you!
     ellen


--_000_CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9CO1PR05MB8315namp_
Content-Type: text/html; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
=09{font-family:"Cambria Math";
=09panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
=09{font-family:Calibri;
=09panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
=09{margin:0in;
=09font-size:11.0pt;
=09font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
=09{mso-style-priority:99;
=09color:#0563C1;
=09text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
=09{mso-style-priority:34;
=09margin-top:0in;
=09margin-right:0in;
=09margin-bottom:0in;
=09margin-left:.5in;
=09font-size:11.0pt;
=09font-family:"Calibri",sans-serif;}
span.EmailStyle20
=09{mso-style-type:personal-reply;
=09font-family:"Calibri",sans-serif;
=09color:windowtext;}
.MsoChpDefault
=09{mso-style-type:export-only;
=09font-size:10.0pt;}
@page WordSection1
=09{size:8.5in 11.0in;
=09margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
=09{page:WordSection1;}
/* List Definitions */
@list l0
=09{mso-list-id:1915697445;
=09mso-list-type:hybrid;
=09mso-list-template-ids:-2017665360 -1393110804 67698713 67698715 67698703=
 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
=09{mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:23.25pt;
=09text-indent:-.25in;}
@list l0:level2
=09{mso-level-number-format:alpha-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:59.25pt;
=09text-indent:-.25in;}
@list l0:level3
=09{mso-level-number-format:roman-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:right;
=09margin-left:95.25pt;
=09text-indent:-9.0pt;}
@list l0:level4
=09{mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:131.25pt;
=09text-indent:-.25in;}
@list l0:level5
=09{mso-level-number-format:alpha-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:167.25pt;
=09text-indent:-.25in;}
@list l0:level6
=09{mso-level-number-format:roman-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:right;
=09margin-left:203.25pt;
=09text-indent:-9.0pt;}
@list l0:level7
=09{mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:239.25pt;
=09text-indent:-.25in;}
@list l0:level8
=09{mso-level-number-format:alpha-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:left;
=09margin-left:275.25pt;
=09text-indent:-.25in;}
@list l0:level9
=09{mso-level-number-format:roman-lower;
=09mso-level-tab-stop:none;
=09mso-level-number-position:right;
=09margin-left:311.25pt;
=09text-indent:-9.0pt;}
ol
=09{margin-bottom:0in;}
ul
=09{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Hi Su and libtiff folks,<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; We just received a slew of 16 libtiff CVEs re=
ported to us by a large customer &#8211; this is in addition to CVE-2022-35=
70 I previously wrote about.&nbsp; I see most of these CVEs are fixed in th=
e libtiff master branch but not yet in an official
 release.<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; I have two questions:<o:p></o:p></p>
<ol style=3D"margin-top:0in" start=3D"1" type=3D"1">
<li class=3D"MsoListParagraph" style=3D"margin-left:-12.75pt;mso-list:l0 le=
vel1 lfo1">
Can anyone provide an update on an estimated release timeframe for a libtif=
f version (presumably 4.5.0) containing all the CVE fixes that have been su=
ccessfully integrated into libtiff master branch since release of 4.4.0?<o:=
p></o:p></li><li class=3D"MsoListParagraph" style=3D"margin-left:-12.75pt;m=
so-list:l0 level1 lfo1">
For newly reported CVE-2022-34266 in <a href=3D"https://nvd.nist.gov/vuln/d=
etail/CVE-2022-34266">
<span style=3D"color:windowtext">https://nvd.nist.gov/vuln/detail/CVE-2022-=
34266</span></a>:&nbsp; I&#8217;m confused about this one.&nbsp; It states =
there&#8217;s a vulneratbility in TIFFFetchStripThing in tif_dirread.c in t=
<span style=3D"color:black;background:white">he libtiff-4.0.3-35.amzn2.0.1
 package for LibTIFF on Amazon Linux 2, and states it&#8217;s a different v=
ulnerability than CVE-2022-0562.&nbsp; The NVD report for CVE-2022-34266 do=
esn&#8217;t contain any links to a libtiff GitLab issue describing the vuln=
erability, but I do see that the libtiff fix for
 CVE-2022-0562 was released in 4.4.0.&nbsp; Can you please let me know if C=
VE-2022-34266 is a new vulnerability that&#8217;s different from CVE-2022-0=
562 as stated in the NVD CVE report?</span><o:p></o:p></li></ol>
<p class=3D"MsoNormal">&nbsp; Thank you,<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp; ellen<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b>From:</b> Ellen Johnson <br>
<b>Sent:</b> Wednesday, October 26, 2022 5:50 PM<br>
<b>To:</b> Sulau &lt;sulau@freenet.de&gt;; tiff@lists.osgeo.org<br>
<b>Subject:</b> RE: [Tiff] clarification on the fix status for new CVE-2022=
-3570?<o:p></o:p></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Hi Su,<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; Thank you so much for clarifying.<o:p></o:p><=
/p>
<p class=3D"MsoNormal">&nbsp; Do you have an estimate on the timeframe for =
release of 4.5.0?<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; Thanks,<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp;&nbsp; ellen<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b>From:</b> Sulau &lt;<a href=3D"mailto:sulau@freen=
et.de">sulau@freenet.de</a>&gt;
<br>
<b>Sent:</b> Wednesday, October 26, 2022 4:51 PM<br>
<b>To:</b> <a href=3D"mailto:tiff@lists.osgeo.org">tiff@lists.osgeo.org</a>=
<br>
<b>Cc:</b> Ellen Johnson &lt;<a href=3D"mailto:ellenj@mathworks.com">ellenj=
@mathworks.com</a>&gt;<br>
<b>Subject:</b> AW: [Tiff] clarification on the fix status for new CVE-2022=
-3570?<o:p></o:p></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span lang=3D"DE" style=3D"color:#1F497D">Hi Ellen,<=
o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"DE" style=3D"color:#1F497D"><o:p>&nbsp=
;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:#1F497D">issues =
381 and 386 are fixed and related MR is merged into the master branch one w=
eek ago. So they will probably be released with next version 4.5.0<o:p></o:=
p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:#1F497D">Regards=
,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:#1F497D">Su<o:p>=
</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:#1F497D"><o:p>&n=
bsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span lang=3D"DE">Von:</span></b><span lang=3D"DE=
"> Tiff [<a href=3D"mailto:tiff-bounces@lists.osgeo.org">mailto:tiff-bounce=
s@lists.osgeo.org</a>]
<b>Im Auftrag von </b>Ellen Johnson<br>
<b>Gesendet:</b> Montag, 24. Oktober 2022 19:05<br>
<b>An:</b> <a href=3D"mailto:tiff@lists.osgeo.org">tiff@lists.osgeo.org</a>=
<br>
<b>Betreff:</b> [Tiff] clarification on the fix status for new CVE-2022-357=
0?<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span lang=3D"DE"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal">Hi libtiff developers,<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">&nbsp; I&#8217;m confused about the new CVE reported=
 in libtiff &gt;=3D 4.4.0 related to the previous CVEs in tiffcrop.c. &nbsp=
;There&#8217;s a lot of comments in the GitLab issues and I&#8217;m trying =
to detangle whether this is fixed in 4.4.0, or in the master branch
 waiting to be released into a new libtiff version, or still open and not y=
et merged into any branch.&nbsp;
<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp;&nbsp;NVD link:&nbsp; <span lang=
=3D"DE"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2022-3570"><span la=
ng=3D"EN-US">https://nvd.nist.gov/vuln/detail/CVE-2022-3570</span></a></spa=
n><o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp; Related libtiff GitLab issue: &nb=
sp;<span lang=3D"DE"><a href=3D"https://gitlab.com/gitlab-org/cves/-/issues=
/479"><span lang=3D"EN-US">https://gitlab.com/gitlab-org/cves/-/issues/479<=
/span></a></span><o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; <o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;From the GitLab posts and merge requests=
, it looks like it&#8217;s related to the previous CVEs fixed in
<span lang=3D"DE"><a href=3D"https://gitlab.com/libtiff/libtiff/-/merge_req=
uests/382"><span lang=3D"EN-US">https://gitlab.com/libtiff/libtiff/-/merge_=
requests/382</span></a></span>.<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp; In these two GitLab issues, the CVE reporter =
is saying they are still open issues in 4.4.0:<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp; &nbsp;<span lang=3D"DE"><a href=3D"http=
s://gitlab.com/libtiff/libtiff/-/issues/381"><span lang=3D"EN-US">https://g=
itlab.com/libtiff/libtiff/-/issues/381</span></a></span><o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp; &nbsp;<span lang=3D"DE"><a href=3D"http=
s://gitlab.com/libtiff/libtiff/-/issues/386"><span lang=3D"EN-US">https://g=
itlab.com/libtiff/libtiff/-/issues/386</span></a></span><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">&nbsp; Can you please advise on the fix status for <=
span lang=3D"DE">
<a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2022-3570"><span lang=3D"EN=
-US">https://nvd.nist.gov/vuln/detail/CVE-2022-3570</span></a></span>?
<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;Thank you!<o:p></o:p></p>
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp;&nbsp; ellen<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>

--_000_CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9CO1PR05MB8315namp_--


--===============5706773825970709980==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tiff

--===============5706773825970709980==--

