Return-Path: <SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org>
Received: from mailfep024.skynet.be ([10.35.4.252])
          by mailafep010-svc.mx.internal
          (InterMail vM.9.07.03.022 201-2473-138-3) with ESMTP
          id <20221104231016.CKJX19247.mailafep010-svc.mx.internal@mailfep024.skynet.be>
          for <chris.lindelaan@skynet.be>; Sat, 5 Nov 2022 00:10:16 +0100
Received: from el9756.bc ([10.27.1.11]) by mailfep024.skynet.be
          (InterMail vM.8.04.03.28.4 201-2389-100-182-103-20180124)
          with ESMTP
          id <20221104231016.XESB11470.mailfep024.skynet.be@el9756.bc>
          for <chris.lindelaan@skynet.be>; Sat, 5 Nov 2022 00:10:16 +0100
Received: from mailgate126.bc ([10.48.11.44])
 by el9756.bc with ngmta
 id d108428a-17248478cf782eb3; Sat, 05 Nov 2022 00:10:16 +0100
Received-SPF: None (mx101.skynet.be: no sender authenticity
  information available from domain of
  tiff-bounces@lists.osgeo.org) identity=pra;
  client-ip=140.211.15.3; receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="tiff-bounces@lists.osgeo.org";
  x-conformance=sidf_compatible
Received-SPF: Pass (mx101.skynet.be: domain of
  SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org
  designates 140.211.15.3 as permitted sender)
  identity=mailfrom; client-ip=140.211.15.3;
  receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text="v=spf1 mx a:mail.osgeo.org a:lists.osgeo.org
  a:mail.osgeo.osuosl.org ip4:140.211.15.3 a:osgeo7.osgeo.org
  a:trac.osgeo.org a:dev.trac.osgeo.org
  a:secure.osgeo.osuosl.org ip4:140.211.15.57
  ip4:140.211.15.32 ip4:140.211.15.26 ip4:140.211.15.6"
Received-SPF: PermError (mx101.skynet.be: cannot correctly
  interpret sender authenticity information from domain of
  postmaster@lists.osgeo.org) identity=helo;
  client-ip=140.211.15.3; receiver=mx101.skynet.be;
  envelope-from="SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org";
  x-sender="postmaster@lists.osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text=""
Authentication-Results: mx101.skynet.be; spf=None smtp.pra=tiff-bounces@lists.osgeo.org; spf=Pass smtp.mailfrom=SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org; spf=PermError smtp.helo=postmaster@lists.osgeo.org; dkim=hardfail (body hash did not verify [final]) header.i=@gmail.com; dkim=hardfail (body hash did not verify [final]) header.i=@gmail.com; dmarc=fail (p=none dis=none) d=gmail.com
IronPort-SDR: 63659bd7_1UCbFYY1J19TYbAdI+p7LMpjEsVXKxMPJ+k9oY/6+EVNSnb
 MHbWPXATqYXFbIuJxR75+5C88OS24+0SK8lvNdg==
X-Proximus-RemoteIp: 140.211.15.3
X-Proximus-Mfrom: SRS0=h4cH=3E=lists.osgeo.org=tiff-bounces@osgeo.org
X-Proximus-Rcpto: chris.lindelaan@skynet.be
X-IPAS-Result: =?us-ascii?q?A0GTAgBwm2VjmAMP04xaHQEBAQEJARIBBQUBQIFPgi0BG?=
 =?us-ascii?q?AFoVisCAQhMhE+IfogcAxaMN5IbOBUBAQIBAQEBAQkuAQwJBAEBAQIEhH4Ch?=
 =?us-ascii?q?HogBQEENBMBAgECAQEBAQEDAgMBAQEBAQEDAQEBBAEBAQIBAQIEAgIBAQIQA?=
 =?us-ascii?q?QEBAgIVCRkFEA4DJIVoDYI1BQIDHwEGC2NKAwMDNQEBAQEBAQEBAQEBAQEBA?=
 =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEEAg1SHygBAR0BAQEBAgEBAQEPER0BB?=
 =?us-ascii?q?QoMEgsBAgEBAQECBgEBBQMCCwYEAQEjBAEDAgIDAR4BBAEMAQUBCwkIBhMFH?=
 =?us-ascii?q?YJbAYJtAQMNIwMFC49gjx+BBEKKOHgCgRUFAhaBAYIJBggDgTYBAwUJAkOVe?=
 =?us-ascii?q?woZKAwBa4FbAgEGEoEuiHEBAYNJg016Q4INelGCRDA+gQVOeBcBAQOCCgmDI?=
 =?us-ascii?q?YJnBI58h2wEBwMEBhQDAwIhAQIBQx0CCQMjBQoDCwkIExcoBgECAQEMB0AEF?=
 =?us-ascii?q?gUfAwEBDyQBAQICAgMEBwIBAwYDDAICAQEBBQYNAwIDCAESAwIBAwUCAgQBA?=
 =?us-ascii?q?gQKCAECAgECBAUHAgEIBgUNBQkLAQECAwcEAxECBQMFBQMDAgEKBQIDAQIBA?=
 =?us-ascii?q?QMGBAQBAQIDAgIBBgICAQEDAwQDAQIGAgIHAgMCAQQCAwMBAQECAgICAgIDA?=
 =?us-ascii?q?wkCCAcFAQYBAgEEAwICAQIHAQQBCAMDBQUJDwMFAwEDAwIUCgUBAwgGCAIEB?=
 =?us-ascii?q?QIFAwIEAgMCAggDAgQDCwMFBAIHBA8HAgMCAgUCAgICAgUEAwECAgICAgIFA?=
 =?us-ascii?q?gMCAQUBAgIBAgICBAECAgcEAgMBAwQOBAMCAgcBAgIBBgIHAwECAQQDAQEEA?=
 =?us-ascii?q?gQBAgUCBAEDBgIEAwoCAgMCAgIGBQMDCggCAwUCBAEBAgcEAgILAQYCBwICA?=
 =?us-ascii?q?xABAwEEBQUDAwMJAgIDAgQCAgoBAQEBAgEHAgQHDQICAgQCAgIBAwICAQECA?=
 =?us-ascii?q?goSAQECAwYEBgUDAggYAQYCAQECAgMDAgYCAQIIAgQBBAUCAQICAgIEAQMGA?=
 =?us-ascii?q?gMBAQIBAgIDAwIBBAIEAwIBAQIBAgICAwICAgMCAgEPAgYGAQICAgICAgICA?=
 =?us-ascii?q?gEFAQIBAgQCBwIEAwIBAgIFAgICAwEBBgIECwEDAgcGAQMCBwUCAwEEAwQDA?=
 =?us-ascii?q?wsFDAgBBQEDARIDCwMCAggCBwIBBgUBDwMCAgMCAgEECgIDBQIEAgEECAcCB?=
 =?us-ascii?q?AECCQMCBgIHBRgBAgIHBAwKAgICBQYCBAEBAQEDAQIBAQIDBAIDAgQFAQUCA?=
 =?us-ascii?q?QIFBAICAQECBQIMAQEHBgIHAgICAgMBBAIBAgEDAwIDAQEBAwYGBQYEAgMDB?=
 =?us-ascii?q?gICAgYCAgMCEQMHAgYDAgQBDQ8FBAUIAQIBAQcCBAIHCQ4CAQYBBQICAwICA?=
 =?us-ascii?q?QUCAQYDAQICAgIFCAUDBAUDBg8DAQEEAwIBAgEEAwIDBwMCBAQDAQIDBAYGA?=
 =?us-ascii?q?QkDAgIGAwICAg0DBAICAQIBAQMEBAYCAgIBAgICAgMBBAICAQEDAwMCAgIDB?=
 =?us-ascii?q?AIDAwsGCggCAgIDAgEFCwQCAwIBAwYJAgQCAgYBAgQCAgICAgICAwEBAwIBB?=
 =?us-ascii?q?wQCAQIDAgIGAwYCAQIBAgEJBQIBCQMBAgECAQQBAwkBAgIECQIDBwUEBgQCA?=
 =?us-ascii?q?gICCAICDgMDAgEBBAICBAUCAgsCAQIHAgUBAQMFBwICAQICAQQDAQkEAQICA?=
 =?us-ascii?q?wIBAQMDEQMDAwEEAgIFAwMNCQYCAgEDAgMBDQMDAQIBAgMBBQUXAwIBCAcDE?=
 =?us-ascii?q?wMCAQEDAgECAgMGBAEIAgIDAwMCAQIFAgQDAwEFAgEBAwEFAwIOAwIDAwMGA?=
 =?us-ascii?q?QIBAQIDAwEMBAUBAQEBFwECAwQCAgEBAgUBBAMBAQIBAgMCAg4GAQQFCwMBA?=
 =?us-ascii?q?h8CAgMDAQQFAgICCAICAgEDAwEDAwUBAgMEAgIBBQQKAgICAgICAgEMAgoDA?=
 =?us-ascii?q?gMBAwUBAQQCCQUBBQECBwIFAgMBAQECAgIGAggCBAsBAwUBBgIBAgECAQUCA?=
 =?us-ascii?q?QECAQKYZYEwFoETaxAgAi4LMQUKPwVcomIOVZ8dY4MOhDyHDo0Lh3syg3iMU?=
 =?us-ascii?q?48RiTmXMIJLiniaJBAjEoFEIwI6gQ4LBzMaCBsVOzGCNk8cD44gF4NbgX+DF?=
 =?us-ascii?q?YVqITQ7AgcBCgEBAwmJDoFuAQE?=
IronPort-PHdr: A9a23:eBWTexCyqdFyVnMscGdCUyQUtk8Y04WdBeb1wqQuh78GSKm/5ZOqZ
 BWZua8xygWTFt2Ho7Ic0qyK6fumATRBqb+681k6OKRWUBEEjchE1ycBO+WiTXPBEfjxciYhF
 95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRoLerpBIHSk9631+ev8JHPfglEnjWwba19I
 RmsswndqMYajZdtJ60szhfFvmZEd/5ZyG92K1+fhQrw6tu18JV+7ylepvUt+tJaX67nZao4V
 7tYDDonM2Ax+sLmsATIQBWM6HUBTGgYiwJEDAfZ4h70WJfxqTb6ufFm2CaGJ832TKs7Viqk4
 qx2VRLnkiYHNzo+8GHKlsx9ib9QrRy9qxBjxYPffZqYP+RicKzDYdwaRHJBXsdPWCxHHoO8d
 JYEA+4YMepFs4Xxu14CoB2wCgm2AOPk1yFGiHn406Yn1+gtCAHL0AkmEtkTsnrbsc/1Ob8dX
 uC7zqbGzTvNYfBI1zng8IjFcBIvreyCUL5sb8fe1VcgFxjeg1WVtYDoJSmY2vgRv2WZ6edrS
 OKhi3QgqwF0ujWhw9osipPVhokI117L6SV5wYgrKt24Uk5wfNmpEIBMuCGaOYp5XMMiQ3tzt
 SY1z70Jo5+7fCwQxJs7wB7fbuWKfo6V6R3sSOifOy13hG55eL2hnRay91Ctx+nyW8S1zVtGs
 itInNnDuH4DyhDf9smKR/pz80u82juDyhze5+NYLU00mqTXNoItz78+mJcOvknOGjH6lVvog
 KKQa04q9O+o6+H9bbXnoJ+RL4B0igDiMqQuh8ywGv40PRQJX2ie4ei80rzj/VblQLlQgf02l
 bfZvIjVJcQauq65BxVa3Z055xmjCDem1cwUnX4cLFJKZh2HiJLlO1bUIPD3C/q0nleikC9zy
 vzbMbDtHo/BImbenLv8Z7px9k5RxBA9wNxH+Z5YFrUMLOjwV0LxrtDUEwE1Pg+uz+r6Cthw2
 IUTUn+VDKCDKqPdq1qI6/ovI+aSYI8Vvy7wK/wk5/71kX85gkURfa6y3ZsYdn+4Ge5qI0KDY
 XrjmtsBEGEKsRQiTOHylVGPXiJfa2ysU64h+z03Ep+qAIfZSo2jmLCB2T20HpxSZmBIEFCMF
 nLoep2ZVfkQdSyePtdskjwLWLe9SYEszR+jugDixrpjL+rU4TEYtYn52Nhy/O3Tmg899TtuA
 8SayWGNQHl5nn8JRz840qBzuFdyylCe0ah+n/NXC8dT6uhOUgchOp7T0et6B8r1WgLbcdeFU
 FCmTc6+DjErUt0x28MOY1p6G9i6kxzPxzCqDKMNl7yXGJw09brR0GTxJ8ZnynbGz7Mtj10nQ
 stJKGKpmKp/+BLJCI7PiEiZjKWqdKQa3CHT6GeP13GBs18LGDN2SrjPCHADelPN/5O+4kLZU
 6ToDq8oPwwHztSNba5Da9nshFMBQ+//OdPYeCWtmmm+ViuO3a6GOY/jemEB23fBCUYK1hoe5
 GuLLhQWAia6v3mYCydhGFWpZFnjpvJjonG2RVNh0geRckd63KC08BNGuPqHVvkz07sItT10q
 yloBE3vmJXSCsGcvExmZ6pRZpU6+lgA0GvYswl0ONunN7xjgVgFNBh2sU296hNsF49gnMEmo
 Wl/yQNzLb6fgk9AeT3dx53pJ7DMNkH2/QuzcOjRwV7T15CR4KhY8+kyqVjooFS0EFE/+W5sy
 dhf3iig4cDnCA4fV9rTVUYx7B987+XXZi0w4YH80HRwMbazqDzZndkuAb125AyneoJ8LbmYX
 DT5E9IXB9LmfPchm0ekbggsM+Vb9apyNMSjIajVkJW3NfptyWr1xV9M55pwhwfVr3cUopPgw
 cNckLmRixGcXnLnjF77756k0YsRfzwWF3qyxW/+CYpYdqB+Ls4HXGirKsyzgN55gs2lQCsCr
 AT6XwpfgpzMG1KSOlf2jxFXh18Kq36qkjfqyjFviDgmo++e0H7CyvjvJhQdPWsZRW8nl1r0J
 Znxk9dIRkWmYhIkkhCo/iOYj/pepaFyanfeW1xJeC6kIXtlV/msseiJaJxU9ZkqvC5LAui1f
 V3IT7PmuBIV3mbiEzlEySg/ZnS2vcac/VRwiDexckZNkWb2e8su3S7n9ZvjeaBz7hBZA3N6p
 gXaA3KkPICy/YWYmpHateGhAjHENNVZJAzq06PfiSmc9TBXGBKVoPqKkf7LEVFk6CXdy4B4Z
 3vJvhjxXpPN9KHhEeheXRJYVU7QwZNGML1Yq9UhgqMhhHgj3fD3tVslv0zeOpJAh7LmXGgMe
 mco39SI0DDagHBjMC6z7t7dXFihhZJqd4m4flwb2B07zP5xM7zO6rBBrw5q/lyfjQvNZdIs+
 1VV6PgR0SAc0r1QqDYo0yHCBYAQAldJL33+rBGE6P6TvZtnaz3xcreZ1RNUnNK9F4GeoyZTa
 XXHS7MNNzQ3wMttc0uPym2WiMnVQvjcaNBPhzC5uUnEzMZ0LbJrptsHxix2I3vEmG0Ol95rp
 xVX+YOqutitdF9O+YL6Gxl7OQToR90Z/DPMiIIdhpu05+XNVtZAQwgyWKP0cdiPUxksit/9K
 zunLRQs7UmaA5+BJQi62nljrlHGEoyVDU2HBFQ26dIlAxi0PW17xy0mAGQ12ZkBODGuoa6pV
 lgk+WVEtRbo7xpWzeRwMAPjF33SvxqsdmI0QYKTIhNX6lIK9wLUK8uY9uVpA2RV5IemtlmHL
 WCKLwRBFmFBVk2IT1bkIvGw6MPB/fnQNeS/KfLKVObmQZ92D7OkwJu12bFr9DGWOpfHJixkC
 Ps2ngJbVmwsQpyB330UU3kOiivXZsiHpRGxvmV+osO+9aHxHErm/pOBXqEWec9y8kWFweiGP
 u+UjTtlKXNC24sL32PT4LcY21EWhmdlcDziVfxZ7XKdEf2Owu5iSxgcbS4b3Kpg6rJlhlALI
 s3KjN7pkLR13bYuE1kQc1vnl4myYNASZXmnPQbbBUiFcb6BODvAztrfZaKnVaYWi/5buhr2v
 iyUQAf4JjrWrzDyTFi0NP1UyiSSPRhQooa4Jy1XMjC2TI7tSkjgHYpzjCYq2vsznXzHMigbK
 zcpb0JDoPia6j5eifhkM2ta4Xdia+6elHXR9PHWf64bq/5GGD5zjapB5WgijbtY6CYRXPtuh
 C7btcJjuXmik/KT0XxgSxVDrXBMno3Y9UlhOKCM9pBaVXjN/RZFrW+XBwVCp9J+CpXjuqwYz
 N/T3Lz+MjZM4prn88oaDszhaYqHPXMtPACvGWv8Aw4MTDrtPmba1ARRk/CXo32ctJQ0o5no0
 NoETbNKHFw8DfNSBkVpVNoFPN9pUykln6/Tv8AJ43O6mViZRMhTsp3dEPPHKfrqITedy7JDY
 khAzbbxN49GOIT63wQicgx8m4LHU0bRRoVLpStsL0c49UpI+Xl6CGY03ioJcyuL53keXb6xj
 kdu001lYvUr+Suq6VplblzN7DA9lkU8g53snCyRfTjtLayxQZAzaWK8tk4/NYn+Shp0agv6l
 FJtNTPNTbZcx7V6cmUjhAjZsJpJUflSKM8MKAMRy//SbfI1119RsQ2jxFRb/q3CEpRvk00ta
 5Ht53NM1gR/bcIkcLTKLfksrBAYjaaPsym0k+EplVZCfwBXqTrUIXNO4x9ALLQtKiu28/Y57
 Bzbw2IFY2sdUfc25PhnpSZfc6yNyTzt17lbJwW/LeuaeumigVOYwM7USXNljW5dk0he4aMw1
 twsfk3SUFogmaeQGRpMP83fLwpYdOJV73feemCJq+qHkvcXd82tU/vlS+ODrvNenkOqEkMjG
 JkK5ckaNp2ty13Da8D8I7MCjxI36064QTfNROQMcxWNnjAdpsi5x5IixohRKAYWBmBlODm27
 LLazuMzqMKKR8x+InIKB9NdcGk1Scu3h2hTsiYIAD6y2+MfgA+Mil207h/qN2Gpb4ZoRKLPS
 EZoCcqq4nM46Ke7jhjQ6JqLO2D0O5FovcLJ4u4Bj5GcBP5TC75nvCK+08FUSmerXGjGDdOub
 8GsM892NIWyUyv8CRS2kHotQt30PcqxI6TAmgzuSYtO8ez5lHgiOcK7CjACCkJ1ruAH6rh7Y
 F5LaJ46bBj08gUmYvXjeEHCi4zoGjvrcmgzLbEX1+ixar1JwjB5a//jkCJmVZIryeSrt0QAF
 /RoxlnTw+iuY45GXG39AHtYLk/0nxFhwmg9PcZnmcpqxBLTrUJaNCuEeesvb3ZL6s09C13XK
 3JrDGE1XHebloXO5Uirxb9YrE4/155ElPZItnTzpMqVWwiXAPmr9Z715nENONwnuLFqd4v4L
 caB8pTEkWnDTZfe9weCTSixGuFyncNfLSUeR+NH0zJAW4ROqc9K7kw/Ud07LrpEBfw3p7ykX
 jFjCDYb0S4TU47TlCxHmOq33KHW0wuBaJl3egJRq41M25FONkw+KjNbvqKoUJ/a0nOJWnRea
 hlG9hxCvUoFhsd5LOXs4Y6OS4RDxjkQpOh7GiKZEphz60C9TXqZjF++T++u9o7hlQsAyfvt1
 p8cQxFyDg5a3PtRjU9uL6t4Y6gI4tyT7mfOLxqj+juwjrDuLQtW0sLZcAK+C5HKuG26VTcTn
 B9cDYYd1GvWHtIViAV0b+AsvloEKdKqd1i4+yYtzMJuBLa1Uoas3VlAzz5OTnWxHtFcEewgt
 0nYVTojZIu2r47hfZJITSdR4MHP8gsB1h80amjglNwBdKQvqnYNRGQd+GnF+oHrEYsahIktV
 dcNOost4iulXvkdYd7I/jts5PTu0iOLomxk9g3jnXPqRunmBYq15kUmFx8sCn6ErVNnT+48q
 z+LtEvOo1Z546FRC+rHhkx3pjFhVptJHCxE3myhPjERBDFHtflXMrzPftAUWPQ0aRK1cxUjC
 f4r2VCI9kBojD/4ZSJ1rA5T5yHaWUE6Ty4QyrvqnDQfrImgN1p4A9pQai49ai7eNw+BsSRWp
 wpELUZxVJ0eRNFf9PBT3IdZ+NbDVVf5KSwBW08HVEpw2v5emEhf9USALHmBVUzyLK+J60AxJ
 pTZtsOiIfXn8R0Sj5O+6Ll+7KYSQXC63wegErW858fxsMOHskyWeeL2Keq5NDX6dgOU2BDsj
 pdxVLSf+ynILBEdLIJ1xH1iZoLuXHLKMxoDLaUGIUFWToh9ctpLpaZdfcAuK8Nrsed9QwmKQ
 B/iAtnltP5dMlPaXijTNQ2F8/ejusTU9rPQTq7nfMPGlBOlC+pne5x97zf8AbLj14RTr1H31
 vla/UR/UVHaMiqFoYepNkYR6cKlbEenoowxEGacHsJriHS0jBIlFYJfU2iw/Z8f0p8c9HvgV
 bcymCAbUcVW9qJ48s8w+L9kzoGzP6iAd5yyVGdjAwOIHUNt7ZogBy54XW8DOof5x9/WZqsUi
 obpse+lTsQq
IronPort-Data: A9a23:jwgX068RdHgPaBkfKtyDDrUDyneTJUtcMsCJ2f8bNWPcYEJGY0x3x
 2FODDiFPvbeZjP0Kdp0aoi29ExV75GHmoUySQJs+y01FSoboMeYX42TcRauZyibJJ2cQBNt5
 ZgVMoORIZBrRyOF9kamP5Hf8UVxhPqCLlbe5E8oGQgoG1A7F31413qPv8Zk2uaEVPDgW1vlV
 eva+pGZYhn8s9JNGjp8w7qZrx9yt+jFtjodv1gvDdhGp1a2e0M9VfrzHonsaSqmKmVoNrTiH
 byalenlpj+xEyoFU7tJrJ6rLSXmfZaPZWBiulIOM4C+jx5LoDAF06pTHJLwvm8O1l1lN/goo
 Dl8ncTYpTUBZ8Ugq8xHO/VsKBySCIUakFPxCSHh7pPMlRSYG5fb664G4EkeZeX08wvsaI1E3
 aRwxDslN3hviw8qqV4SpyYFaskLdaHW0I0jVn5IzBXeF68GHoH4e/vju9sD9xw2lN9cEqOLD
 yYZQWIHgBXoZxxUJkxRD4kxkeDugWPwG9FagAvJ/extujGVlVE3i9ABM/KNEjCObf5vpR7Np
 j7N3zGiL0QeNceD0nyC6X2hganIhyyuRIMcGviy8eNsi1CI7msIBxARE1yhrpFVj2buAokAc
 hVEpHdGQa4arGaJY+nBcCyBkWeuvT1fBZlsTMY3wVTYokbTy13FVjVVEGIphMYdnMQ2Xz0xk
 FuImd/kATVmtpWOSmOb+6vSpz7aBMQOBWgZaiIDE00C+Nbup8c0lQ/IVdIlF7S65jHoJd3u6
 zGuqzJnp+oCtvZV/vu/pnvshSCztJecG2bZ+T7rdm6i6wp4YqusaIqp9UXX4J58EWqJcrWSl
 CRYxZXDt4jiGbnIzXbWGb5QRNlF8t7caGW0vLJ5I3U2G91BEVaKeYpZ5iAWyKxBY5lfI2aBj
 KM+X2psCHJ7O2ClYKgpJYWqBMkti6/7CNP+UrbTdNUmjnlNmO2vo3sGia24hTiFfK0QfUcXZ
 cnznSGEUSpyNEif5GDqL9rxKJdyrszE+UvdRIrg0zOs2qeEaXieRN8taQXQMb1psv3f+16Lq
 L6z0vdmLT0CAIUShQGKrOYuwawidCJT6W3e8pMLLr7bSuaYMDhwVpc9Po/Ni6Q+w/QIx7mUl
 p1McklV1EX4n36PJwKQIn1vdbjmQZd4qzoyOyBkJ1uz1nE5aobn7aFXcIE6cr4hnNGPPtYqJ
 8Tpj/6oW6wVIhyeomx1RcCk/ORKKUr27SrTYXvNSGZlI/ZIGVeTkve6JVSHycX7Jnft3SfIi
 +f+hlqzrFtqb1kKMfs6n9r2lgzq4yRDwL4rN6YKS/EKEHjRHEFRA3GZptc4JsgNLVPIwT7y6
 upcKUpwSTDl+tNvrov6luqfop23EuBzOENfEiOJpfy1LCTWtC7ri4NJTO/CL3iXWXLW6ZeSQ
 7xf78j9F/kbw3dMkY53SIhwwYwEutDAmr59zyZfJkvtUWiFML1aHyS57ZF9jZEVnr59kimqa
 32L4ehfaOmoOtu6MVs/JzgFT+Wk1NMKkWPe6f4kfVvx4SR22JGlUkxiGQaGpwIADblyMaIjm
 fwAvuxP4SOBqxMaCPS0pQEKyHatd1suC74GsLMeC6/V0jsb8ElIO8HgO3Wn8aOxZMVpGWh0B
 D2t3Y7ppalWn2jGeFoNTUn95/JX38kyiUob3W05Bgq7n/TejaUKxzxXyzM8SzpVwjhh0+5eP
 mtKNVV/FZ6R/gVH1dRyYGSxJz5vXBGp2FT9618spl3rS0OFUm/sLmpkN92do2Ef0WZXJQZA8
 J+ilW3KbDfNfePK5BUUZ3JLkfLYYOJUyhzjg+GiRsSMIIk7a2Hqg4iofms5lCHkCsIQ2mzCt
 fFhp9xiTaiqJxxKnbMfDtiL56UxUzGBHnRJGtt6zZMKHEbdWTC84iePIEaPYfFwJ+TG3Eu7K
 s52LOddfk2a+AfXiR5DHo8KAbt/vMBx1eo4YrmxeFI36eqOnARmoLf713bYhlZyZ/5MjMxkC
 IfaVwzaI1yqnXEOxlP89phVCFGZP+sBShb3ht2u0eMzEJkGjuFgXGcy3pawvFSXKAFXxA2Vj
 iySe57py/Fe9qo0k7vOCqljAyCGGeH3XsmM8yGxtI1AVsOQEMHsswhOlELrET4LNpQsWvN2t
 4+3jvjJ4G3/so0baVvpw6u6K/ER5OGZfvZmDcbsHXwLwQqAQJDN5jUAyUCZKLtIstVX2ee/T
 SDlasHqLd8xcPVezU1zdCJxPUs8CaP2T6G4vgK7ja2GJSY82Dz9DuGM1CHWf0ACUQQXKbjSN
 xTSh8++wvx58KFdGw4iBdx9Jp1zfW/YRqotcuPuuQmiDmWHhk2Ivp3gn0EC7Q7nJ2alEsHox
 4DsXTn7KQqPvZ/XwOFjs4BdugMdCFB/i7ISemMf49tHtCCoPlUZLOgyMYQ0Nb8Mq3bcjKrHX
 TDqaHcuLQ7fXj4eKBX134nFbzelX+cLPo/0Gywt80aqcByJPYKnAoUw0gd74nxzRCnv8/H/F
 /Ea5U/LH0aQxrNHeL8tw8KV0MJc+NXn+E9VxX7Ass3WKDQCMIoOz01kTVZsVzSYMsTjl3frB
 GkSREJfSXGdEUXgTNhrIXJREgBEojjqxDQMRgWMyeb5pI+04rBhyvr+GueryZwFTp0AC4AvT
 EPNZVmmwj6pyFkMn5A2qvQVgaNQItCaLPiQdaPMa1UboPCt1z4BIcgHoxsqcOgj3wxuS3Xmi
 Tim5ikFNnSvcUx+9uWf9lQUxshXTHkJMjDuiTz/rx/glTgS7YDQWzqu/TLBBaDAkYrRlGQGf
 25Kd2eUmUOcixX8rzontvg7mE2OMftMKVb6CBIXXrHAuTbybl8FD71w8VAI5/QI+l1++4hkX
 qKw0dI8xYGZYh2yzz3UxMc7X+FdkYsFPDo6ip7y3RcyFtKPxILxKNm4DbChTzctuxJ9WHVf8
 8jDc1eEMxDytFhDbGZbpenUGo1O+5Wj9rcC8F5kJ9triryd9Zk+mpCD/gilfjpNZ5iBTYqua
 Ebw4+6xNAQeeHXBS5F3rA4j04L6/elOyBDQtnH8PgXK65ndqnBaf9Rd76QFgeuodCRHEEU66
 UXRRfvSlojV1GinsR+pw2Lq37M3Khjq8IU6UBakIm/JIB8QpINUi6+tlPOthi0SRaFjFqt08
 FdaEBDx5sjWy1QNanmdRT9TYRHMNg2uNqqoAsQ2bdKtwM3IdYkxK5RBvl9KUeJF/UNersgve
 Gv+I7qqztkUJLFOPZSJsVWpWiEqEYfQNFWynNG6g3sbeIXMZHVaLXYpwNfM5GAuCPKTpIg/h
 uIWkLR43Hbe2NY2ilhByni9Ve+//v5N6TrwyTqihGlZaeLlf/h7Cn4k285/rIb1qGkvjm93P
 k+QbTkbyrJ/WCfzMS2gO0A2vTAqnjHDYxqExSuUKBgONBCouFdKGlEH7Vr+5b22wR98A/2qD
 7pZoAHryVOd/psHudK9AmUS
IronPort-HdrOrdr: A9a23:JzTD168YEQ37oGNz+YBuk+AyI+orL9Y04lQ7vn2ZKSY+TiVXrb
 HdoB17726AtN91Yh4dcL+7Sc+9qE3nhOpICOUqTNCftUzdyQ+VxK8L1/qT/9TLIVyAygZlvZ
 0QApSX4rXLfCtHZL/BkXeF+rUbsbu6GcKT9J7jJixWPH1Xgshbhm8TZ2qm+w9NNWx77LUCZe
 2hD6F81kGdkBosH7yG7rhsZZm4mzQJrvPbiNw9aSLPJDPvsdsmgISKbiRwFy1uMA9y/Q==
X-IronPort-Anti-Spam-Filtered: true
X-MGA-submission: =?us-ascii?q?MDGCYtQldP5Z3Y2NK34bxD2y4MbsUC78cPlQBC?=
 =?us-ascii?q?XX+XxYD/GIr0PDaoGKl5BJIWsAAAP/Snnmb9C/assUO7H0BO32nA0wZT?=
 =?us-ascii?q?Zdrrl8nL4LRKJJRn8a8XfrzAaES2kpKgX1u7Y=3D?=
Received: from osgeo6.osgeo.osuosl.org (HELO lists.osgeo.org) ([140.211.15.3])
  by mx101.skynet.be with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2022 00:10:13 +0100
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id 90D19614216C;
	Fri,  4 Nov 2022 16:10:05 -0700 (PDT)
Received: from mail-yw1-f173.google.com (mail-yw1-f173.google.com
 [209.85.128.173])
 by lists.osgeo.org (Postfix) with ESMTPS id 9932D6146831
 for <tiff@lists.osgeo.org>; Fri,  4 Nov 2022 16:10:03 -0700 (PDT)
Received: by mail-yw1-f173.google.com with SMTP id
 00721157ae682-36cbcda2157so56343257b3.11
 for <tiff@lists.osgeo.org>; Fri, 04 Nov 2022 16:10:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=cc:to:subject:message-id:date:from:in-reply-to:references
 :mime-version:from:to:cc:subject:date:message-id:reply-to;
 bh=D6XVUtGjb6pQPy/WT6JXB7/2jGTemBpk1sh8denqoiw=;
 b=MivH7UjOx5UqgBWbQcKDh16QbNt1zZ6izfeTrNKm3HbQK3X9yDB1TBTNQ6ynZY5hQ3
 IJFCEc/s6xpXziW1Ktb5XPW0Uhv4RA4LbET/1cx8jtWejWnKVSSs2ndmZMw4nOHatlB9
 IkWQ6n941xTmul7oXjwvyz9zSmdoFEyVXg36kgAi1BijtsXtiOgYkVYLGBs/Ffz+q+rx
 YRIdmj4YEEB6l+FImH2XIe+nyrqQMxC4X8BaQLzxn8B7RKmH+qoKgQuHvbnjImL+p5JP
 +I1UQlPtTBO+CVWCrtUAUAx/VirM6PoMZVmiKaitVRTxHEGLo//iAqIL/EZ49g/oPFYl
 Nw5w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=cc:to:subject:message-id:date:from:in-reply-to:references
 :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=D6XVUtGjb6pQPy/WT6JXB7/2jGTemBpk1sh8denqoiw=;
 b=ZecxLs64Zk4b+xIo1+BPwm12l2OpxKZvABZzlXEYWPREkLLd9mbidnuIuf43LFdcpY
 tCh0JcvP6mXvSBJKdBcq/bMJBGsfiXPtfaOKrzI1KsGSrcsvc7LMqcLRlZLRFNWfaBgQ
 M7aivndDviOnidJqAPKK8r21U4Z89Gt8mNxN6c2W4oagdeHBiif7i41B+3Kb8I3j5Y14
 VDFn9VSpdrUrAYNk7PplBEf2qvX2jlHUbluWlxHjgMrhCd6ewvAiEUgCUrTaYDT0ig/m
 +psp2bHo8FA+oAaxoVH9vHnUnPhalfAimOlHVkCgTJjtH5bGnx9HcfBWSa2nxBTtBYLM
 istw==
X-Gm-Message-State: ACrzQf21DkgijMQaZNX0f/YoYWLC/sInbMABBfS+Z6FbgGiqILon4qSQ
 J0yoFO+wcRl0SOZU0JaopnGXZ7BiW2e35CC97lg=
X-Google-Smtp-Source: AMsMyM7wwPyZqLX2YGY99gc/OS8ITk6konc8ywC9MwIg3YQJfEpxIqKQV+xGqfsIKeN9LKj1na2v5z9t9ziEYq8InCo=
X-Received: by 2002:a81:8046:0:b0:36a:59bc:4b09 with SMTP id
 q67-20020a818046000000b0036a59bc4b09mr36869668ywf.126.1667603402564; Fri, 04
 Nov 2022 16:10:02 -0700 (PDT)
MIME-Version: 1.0
References: <CO1PR05MB8315921C39C2C0E205E48E62D32E9@CO1PR05MB8315.namprd05.prod.outlook.com>
 <!&!AAAAAAAAAAAYAAAAAAAAAEUNXr1cc6FEs82BI4LfFJfCgAAAEAAAAC39sxgi9ptAi/mVqJTZA+UBAAAAAA==@freenet.de>
 <CO1PR05MB8315397904224AA0E44FFF84D3309@CO1PR05MB8315.namprd05.prod.outlook.com>
 <CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9@CO1PR05MB8315.namprd05.prod.outlook.com>
In-Reply-To: <CO1PR05MB8315E4A8FFDD50AF504E6B83D33B9@CO1PR05MB8315.namprd05.prod.outlook.com>
From: Kurt Schwehr <schwehr@gmail.com>
Date: Fri, 4 Nov 2022 16:09:51 -0700
Message-ID: <CACmBxyuWYGj+PuDzQG9f2THK=ntRJU=mg4dS7TSOiWuyHn6Jgw@mail.gmail.com>
To: Ellen Johnson <ellenj@mathworks.com>
Subject: Re: [Tiff] clarification on the fix status for new CVE-2022-3570?
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
Cc: "tiff@lists.osgeo.org" <tiff@lists.osgeo.org>
Content-Type: multipart/mixed; boundary="===============2752797019526248623=="
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>
X-VadeSecure-Score: -105
X-VadeSecure-Verdict: clean
X-VadeSecure-Cause: gggruggvucftvghtrhhoucdtuddrgedvgedrvddvgddthecutefuodetgg
 dotefrodftvfcurfhrohhfihhlvgemucfrtffqigfkofgfufenuceurghilhhouhhtmecufedtude
 nucesvcftvggtihhpihgvnhhtshculddquddttddmnegfrhhlucfvnfffucdlqdehmdenucfjughr
 peggfhgjhfffkffvufhpjefjudeftdevtggvshesmhdtreertddtjeenucfhrhhomhepmfhurhhtu
 cfutghhfigvhhhruceoshgthhifvghhrhesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnh
 eptedvgfeftdehueejfeefveevieehveekvddtudfghefhhffgtdevhedtheelteeinecuffhomhg
 rihhnpehgihhthhhusgdrtghomhdpghhtihhffhhfuhiiiigvrhdrtggtpdhnihhsthdrghhovhdp
 ghhithhlrggsrdgtohhmpdhoshhgvghordhorhhgnecukfhppedugedtrddvuddurdduhedrfedpv
 ddtledrkeehrdduvdekrddujeefnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinh
 gvthepudegtddrvdduuddrudehrdefpdhmrghilhhfrhhomhepufftufdtpehhgegtjfepfefgpeh
 lihhsthhsrdhoshhgvghordhorhhgpehtihhffhdqsghouhhntggvshesohhsghgvohdrohhrghdp
 nhgspghrtghpthhtohepuddprhgtphhtthhopegthhhrihhsrdhlihhnuggvlhgrrghnsehskhihn
 hgvthdrsggvpdhmohguvgepshhmthhp

--===============2752797019526248623==
Content-Type: multipart/alternative; boundary="0000000000006fabea05ecad2c14"

--0000000000006fabea05ecad2c14
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Ellen,

A side note:  (I'm pretty sure I've shared this in the past, but I can't
remember where)

I use libtiff from head for Google.  That way...

- can report any troubles right away back to the maintainers and reports
and patches are easier
- usually ahead of the CVE game.  CVEs have not been helpful to me
- There are enough tests in our system that each update does a pretty good
job of exercising libtiff.  While MatLab isn't the size of google3, it's
probably big enough to have good confidence in deploying tiff from head.
- I have a pretty large fuzzer generated corpus that gets checked daily in
asan and msan mode.  It's not hard to make your own corpus e.g.
gtiff_fuzzer.cc
<https://github.com/schwehr/gdal-autotest2/blob/master/cpp/frmts/gtiff/gtif=
f_fuzzer.cc>
which
is apache 2.0 licensed and the fuzzers in the gdal code base.
- never have to ask for a point releases

As always, thanks to everyone who contributes to libtiff!

-kurt


On Fri, Nov 4, 2022 at 2:12 PM Ellen Johnson <ellenj@mathworks.com> wrote:

> Hi Su and libtiff folks,
>
>   We just received a slew of 16 libtiff CVEs reported to us by a large
> customer =E2=80=93 this is in addition to CVE-2022-3570 I previously wrot=
e about.
> I see most of these CVEs are fixed in the libtiff master branch but not y=
et
> in an official release.
>
>   I have two questions:
>
>    1. Can anyone provide an update on an estimated release timeframe for
>    a libtiff version (presumably 4.5.0) containing all the CVE fixes that=
 have
>    been successfully integrated into libtiff master branch since release =
of
>    4.4.0?
>    2. For newly reported CVE-2022-34266 in
>    https://nvd.nist.gov/vuln/detail/CVE-2022-34266:  I=E2=80=99m confused=
 about
>    this one.  It states there=E2=80=99s a vulneratbility in TIFFFetchStri=
pThing in
>    tif_dirread.c in the libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on
>    Amazon Linux 2, and states it=E2=80=99s a different vulnerability than
>    CVE-2022-0562.  The NVD report for CVE-2022-34266 doesn=E2=80=99t cont=
ain any links
>    to a libtiff GitLab issue describing the vulnerability, but I do see t=
hat
>    the libtiff fix for CVE-2022-0562 was released in 4.4.0.  Can you plea=
se
>    let me know if CVE-2022-34266 is a new vulnerability that=E2=80=99s di=
fferent from
>    CVE-2022-0562 as stated in the NVD CVE report?
>
>   Thank you,
>
>     ellen
>
>
>
> *From:* Ellen Johnson
> *Sent:* Wednesday, October 26, 2022 5:50 PM
> *To:* Sulau <sulau@freenet.de>; tiff@lists.osgeo.org
> *Subject:* RE: [Tiff] clarification on the fix status for new
> CVE-2022-3570?
>
>
>
> Hi Su,
>
>   Thank you so much for clarifying.
>
>   Do you have an estimate on the timeframe for release of 4.5.0?
>
>   Thanks,
>
>      ellen
>
>
>
> *From:* Sulau <sulau@freenet.de>
> *Sent:* Wednesday, October 26, 2022 4:51 PM
> *To:* tiff@lists.osgeo.org
> *Cc:* Ellen Johnson <ellenj@mathworks.com>
> *Subject:* AW: [Tiff] clarification on the fix status for new
> CVE-2022-3570?
>
>
>
> Hi Ellen,
>
>
>
> issues 381 and 386 are fixed and related MR is merged into the master
> branch one week ago. So they will probably be released with next version
> 4.5.0
>
>
>
> Regards,
>
> Su
>
>
>
> *Von:* Tiff [mailto:tiff-bounces@lists.osgeo.org
> <tiff-bounces@lists.osgeo.org>] *Im Auftrag von *Ellen Johnson
> *Gesendet:* Montag, 24. Oktober 2022 19:05
> *An:* tiff@lists.osgeo.org
> *Betreff:* [Tiff] clarification on the fix status for new CVE-2022-3570?
>
>
>
> Hi libtiff developers,
>
>
>
>   I=E2=80=99m confused about the new CVE reported in libtiff >=3D 4.4.0 r=
elated to
> the previous CVEs in tiffcrop.c.  There=E2=80=99s a lot of comments in th=
e GitLab
> issues and I=E2=80=99m trying to detangle whether this is fixed in 4.4.0,=
 or in the
> master branch waiting to be released into a new libtiff version, or still
> open and not yet merged into any branch.
>
>     NVD link:  https://nvd.nist.gov/vuln/detail/CVE-2022-3570
>
>     Related libtiff GitLab issue:
> https://gitlab.com/gitlab-org/cves/-/issues/479
>
>
>
>   From the GitLab posts and merge requests, it looks like it=E2=80=99s re=
lated to
> the previous CVEs fixed in
> https://gitlab.com/libtiff/libtiff/-/merge_requests/382.
>
>   In these two GitLab issues, the CVE reporter is saying they are still
> open issues in 4.4.0:
>
>     https://gitlab.com/libtiff/libtiff/-/issues/381
>
>     https://gitlab.com/libtiff/libtiff/-/issues/386
>
>
>
>   Can you please advise on the fix status for
> https://nvd.nist.gov/vuln/detail/CVE-2022-3570?
>
>   Thank you!
>
>      ellen
>
>
> _______________________________________________
> Tiff mailing list
> Tiff@lists.osgeo.org
> https://lists.osgeo.org/mailman/listinfo/tiff
>

--0000000000006fabea05ecad2c14
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Ellen,<div><br></div><div>A side note:=C2=A0 (I&#39;m p=
retty sure I&#39;ve shared this in the past, but I can&#39;t remember where=
)</div><div><br></div><div>I use libtiff from head for Google.=C2=A0 That w=
ay...</div><div><br></div><div>- can report any troubles right away back to=
 the maintainers and reports and patches are easier<br></div><div>- usually=
 ahead of the CVE game.=C2=A0 CVEs have not been helpful to me</div><div>- =
There are enough tests in our system that each update does a pretty good jo=
b of exercising=C2=A0libtiff.=C2=A0 While MatLab isn&#39;t the size of goog=
le3, it&#39;s probably big enough to have good confidence in deploying tiff=
 from head.</div><div>- I have a pretty large fuzzer generated corpus that =
gets checked daily in asan and msan mode.=C2=A0 It&#39;s not hard to make y=
our own corpus e.g.=C2=A0<a href=3D"https://github.com/schwehr/gdal-autotes=
t2/blob/master/cpp/frmts/gtiff/gtiff_fuzzer.cc">gtiff_fuzzer.cc</a>=C2=A0wh=
ich is apache 2.0 licensed and the fuzzers in the gdal code base.</div><div=
><div>- never have to ask for a point releases</div><br class=3D"gmail-Appl=
e-interchange-newline"></div><div>As always, thanks to everyone who contrib=
utes to libtiff!</div><div><br></div><div>-kurt</div><div><br></div></div><=
br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri,=
 Nov 4, 2022 at 2:12 PM Ellen Johnson &lt;<a href=3D"mailto:ellenj@mathwork=
s.com">ellenj@mathworks.com</a>&gt; wrote:<br></div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,=
204,204);padding-left:1ex"><div class=3D"msg4675693712820303103">





<div lang=3D"EN-US" style=3D"overflow-wrap: break-word;">
<div class=3D"m_4675693712820303103WordSection1">
<p class=3D"MsoNormal">Hi Su and libtiff folks,<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 We just received a slew of 16 libtiff CVEs re=
ported to us by a large customer =E2=80=93 this is in addition to CVE-2022-=
3570 I previously wrote about.=C2=A0 I see most of these CVEs are fixed in =
the libtiff master branch but not yet in an official
 release.<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 I have two questions:<u></u><u></u></p>
<ol style=3D"margin-top:0in" start=3D"1" type=3D"1">
<li class=3D"m_4675693712820303103MsoListParagraph">
Can anyone provide an update on an estimated release timeframe for a libtif=
f version (presumably 4.5.0) containing all the CVE fixes that have been su=
ccessfully integrated into libtiff master branch since release of 4.4.0?<u>=
</u><u></u></li><li class=3D"m_4675693712820303103MsoListParagraph">
For newly reported CVE-2022-34266 in <a href=3D"https://nvd.nist.gov/vuln/d=
etail/CVE-2022-34266" target=3D"_blank">
<span style=3D"color:windowtext">https://nvd.nist.gov/vuln/detail/CVE-2022-=
34266</span></a>:=C2=A0 I=E2=80=99m confused about this one.=C2=A0 It state=
s there=E2=80=99s a vulneratbility in TIFFFetchStripThing in tif_dirread.c =
in t<span style=3D"color:black;background:white">he libtiff-4.0.3-35.amzn2.=
0.1
 package for LibTIFF on Amazon Linux 2, and states it=E2=80=99s a different=
 vulnerability than CVE-2022-0562.=C2=A0 The NVD report for CVE-2022-34266 =
doesn=E2=80=99t contain any links to a libtiff GitLab issue describing the =
vulnerability, but I do see that the libtiff fix for
 CVE-2022-0562 was released in 4.4.0.=C2=A0 Can you please let me know if C=
VE-2022-34266 is a new vulnerability that=E2=80=99s different from CVE-2022=
-0562 as stated in the NVD CVE report?</span><u></u><u></u></li></ol>
<p class=3D"MsoNormal">=C2=A0 Thank you,<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0=C2=A0 ellen<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b>From:</b> Ellen Johnson <br>
<b>Sent:</b> Wednesday, October 26, 2022 5:50 PM<br>
<b>To:</b> Sulau &lt;<a href=3D"mailto:sulau@freenet.de" target=3D"_blank">=
sulau@freenet.de</a>&gt;; <a href=3D"mailto:tiff@lists.osgeo.org" target=3D=
"_blank">tiff@lists.osgeo.org</a><br>
<b>Subject:</b> RE: [Tiff] clarification on the fix status for new CVE-2022=
-3570?<u></u><u></u></p>
</div>
</div>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Hi Su,<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 Thank you so much for clarifying.<u></u><u></=
u></p>
<p class=3D"MsoNormal">=C2=A0 Do you have an estimate on the timeframe for =
release of 4.5.0?<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 Thanks,<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0=C2=A0=C2=A0 ellen<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b>From:</b> Sulau &lt;<a href=3D"mailto:sulau@freen=
et.de" target=3D"_blank">sulau@freenet.de</a>&gt;
<br>
<b>Sent:</b> Wednesday, October 26, 2022 4:51 PM<br>
<b>To:</b> <a href=3D"mailto:tiff@lists.osgeo.org" target=3D"_blank">tiff@l=
ists.osgeo.org</a><br>
<b>Cc:</b> Ellen Johnson &lt;<a href=3D"mailto:ellenj@mathworks.com" target=
=3D"_blank">ellenj@mathworks.com</a>&gt;<br>
<b>Subject:</b> AW: [Tiff] clarification on the fix status for new CVE-2022=
-3570?<u></u><u></u></p>
</div>
</div>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><span lang=3D"DE" style=3D"color:rgb(31,73,125)">Hi =
Ellen,<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"DE" style=3D"color:rgb(31,73,125)"><u>=
</u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:rgb(31,73,125)">=
issues 381 and 386 are fixed and related MR is merged into the master branc=
h one week ago. So they will probably be released with next version 4.5.0<u=
></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:rgb(31,73,125)">=
<u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:rgb(31,73,125)">=
Regards,<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:rgb(31,73,125)">=
Su<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-GB" style=3D"color:rgb(31,73,125)">=
<u></u>=C2=A0<u></u></span></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b><span lang=3D"DE">Von:</span></b><span lang=3D"DE=
"> Tiff [<a href=3D"mailto:tiff-bounces@lists.osgeo.org" target=3D"_blank">=
mailto:tiff-bounces@lists.osgeo.org</a>]
<b>Im Auftrag von </b>Ellen Johnson<br>
<b>Gesendet:</b> Montag, 24. Oktober 2022 19:05<br>
<b>An:</b> <a href=3D"mailto:tiff@lists.osgeo.org" target=3D"_blank">tiff@l=
ists.osgeo.org</a><br>
<b>Betreff:</b> [Tiff] clarification on the fix status for new CVE-2022-357=
0?<u></u><u></u></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span lang=3D"DE"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal">Hi libtiff developers,<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">=C2=A0 I=E2=80=99m confused about the new CVE report=
ed in libtiff &gt;=3D 4.4.0 related to the previous CVEs in tiffcrop.c.=C2=
=A0 There=E2=80=99s a lot of comments in the GitLab issues and I=E2=80=99m =
trying to detangle whether this is fixed in 4.4.0, or in the master branch
 waiting to be released into a new libtiff version, or still open and not y=
et merged into any branch.=C2=A0
<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0=C2=A0=C2=A0NVD link:=C2=A0 <span lang=
=3D"DE"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2022-3570" target=
=3D"_blank"><span lang=3D"EN-US">https://nvd.nist.gov/vuln/detail/CVE-2022-=
3570</span></a></span><u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0=C2=A0 Related libtiff GitLab issue: =C2=
=A0<span lang=3D"DE"><a href=3D"https://gitlab.com/gitlab-org/cves/-/issues=
/479" target=3D"_blank"><span lang=3D"EN-US">https://gitlab.com/gitlab-org/=
cves/-/issues/479</span></a></span><u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 <u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0From the GitLab posts and merge requests=
, it looks like it=E2=80=99s related to the previous CVEs fixed in
<span lang=3D"DE"><a href=3D"https://gitlab.com/libtiff/libtiff/-/merge_req=
uests/382" target=3D"_blank"><span lang=3D"EN-US">https://gitlab.com/libtif=
f/libtiff/-/merge_requests/382</span></a></span>.<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0 In these two GitLab issues, the CVE reporter =
is saying they are still open issues in 4.4.0:<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0 =C2=A0<span lang=3D"DE"><a href=3D"http=
s://gitlab.com/libtiff/libtiff/-/issues/381" target=3D"_blank"><span lang=
=3D"EN-US">https://gitlab.com/libtiff/libtiff/-/issues/381</span></a></span=
><u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0 =C2=A0<span lang=3D"DE"><a href=3D"http=
s://gitlab.com/libtiff/libtiff/-/issues/386" target=3D"_blank"><span lang=
=3D"EN-US">https://gitlab.com/libtiff/libtiff/-/issues/386</span></a></span=
><u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">=C2=A0 Can you please advise on the fix status for <=
span lang=3D"DE">
<a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2022-3570" target=3D"_blank=
"><span lang=3D"EN-US">https://nvd.nist.gov/vuln/detail/CVE-2022-3570</span=
></a></span>?
<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0Thank you!<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0=C2=A0=C2=A0=C2=A0 ellen<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
</div>
</div>

_______________________________________________<br>
Tiff mailing list<br>
<a href=3D"mailto:Tiff@lists.osgeo.org" target=3D"_blank">Tiff@lists.osgeo.=
org</a><br>
<a href=3D"https://lists.osgeo.org/mailman/listinfo/tiff" rel=3D"noreferrer=
" target=3D"_blank">https://lists.osgeo.org/mailman/listinfo/tiff</a><br>
</div></blockquote></div>

--0000000000006fabea05ecad2c14--

--===============2752797019526248623==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tiff

--===============2752797019526248623==--
