Security update for tiff

SUSE Security Update: Security update for tiff
Announcement ID: SUSE-SU-2018:1179-1
Rating: moderate
References: #1007280 #1011107 #1011845 #1017688 #1017690 #1017691 #1017692 #1031255 #1046077 #1048937 #1074318 #960341 #983436
Affected Products:
  • SUSE Linux Enterprise Software Development Kit 11-SP4
  • SUSE Linux Enterprise Server 11-SP4
  • SUSE Linux Enterprise Debuginfo 11-SP4

  • An update that solves 11 vulnerabilities and has two fixes is now available.

    Description:



    This update for tiff fixes the following issues:

    - CVE-2016-9453: The t2p_readwrite_pdf_image_tile function allowed remote
    attackers to cause a denial of service (out-of-bounds write and crash)
    or possibly execute arbitrary code via a JPEG file with a
    TIFFTAG_JPEGTABLES of length one (bsc#1011107).
    - CVE-2016-5652: An exploitable heap-based buffer overflow existed in the
    handling of TIFF images in the TIFF2PDF tool. A crafted TIFF document
    can lead to a heap-based buffer overflow resulting in remote code
    execution. Vulnerability can be triggered via a saved TIFF file
    delivered by other means (bsc#1007280).
    - CVE-2017-11335: There is a heap based buffer overflow in
    tools/tiff2pdf.c via a PlanarConfig=Contig image, which caused a more
    than one hundred bytes out-of-bounds write (related to the ZIPDecode
    function in tif_zip.c). A crafted input may lead to a remote denial of
    service attack or an arbitrary code execution attack (bsc#1048937).
    - CVE-2016-9536: tools/tiff2pdf.c had an out-of-bounds write
    vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip().
    Reported as MSVR 35098, aka "t2p_process_jpeg_strip
    heap-buffer-overflow." (bsc#1011845)
    - CVE-2017-9935: In LibTIFF, there was a heap-based buffer overflow in the
    t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could
    lead to different damages. For example, a crafted TIFF document can lead
    to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or
    t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free
    in t2p_free. Given these possibilities, it probably could cause
    arbitrary code execution (bsc#1046077).
    - CVE-2017-17973: There is a heap-based use-after-free in the
    t2p_writeproc function in tiff2pdf.c. (bsc#1074318)
    - CVE-2015-7554: The _TIFFVGetField function in tif_dir.c allowed
    attackers to cause a denial of service (invalid memory write and crash)
    or possibly have unspecified other impact via crafted field data in an
    extension tag in a TIFF image (bsc#960341).
    - CVE-2016-5318: Stack-based buffer overflow in the _TIFFVGetField
    function allowed remote attackers to crash the application via a crafted
    tiff (bsc#983436).
    - CVE-2016-10095: Stack-based buffer overflow in the _TIFFVGetField
    function in tif_dir.c allowed remote attackers to cause a denial of
    service (crash) via a crafted TIFF file (bsc#1017690,).
    - CVE-2016-10268: tools/tiffcp.c allowed remote attackers to cause a
    denial of service (integer underflow and heap-based buffer under-read)
    or possibly have unspecified other impact via a crafted TIFF image,
    related to "READ of size 78490" and libtiff/tif_unix.c:115:23
    (bsc#1031255)
    - An overlapping of memcpy parameters was fixed which could lead to
    content corruption (bsc#1017691).
    - Fixed an invalid memory read which could lead to a crash (bsc#1017692).
    - Fixed a NULL pointer dereference in TIFFReadRawData (tiffinfo.c) that
    could crash the decoder (bsc#1017688).

    Patch Instructions:

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Software Development Kit 11-SP4:
      zypper in -t patch sdksp4-tiff-13594=1
    • SUSE Linux Enterprise Server 11-SP4:
      zypper in -t patch slessp4-tiff-13594=1
    • SUSE Linux Enterprise Debuginfo 11-SP4:
      zypper in -t patch dbgsp4-tiff-13594=1

    Package List:

    • SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):
      • libtiff-devel-3.8.2-141.169.3.1
    • SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64):
      • libtiff-devel-32bit-3.8.2-141.169.3.1
    • SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
      • libtiff3-3.8.2-141.169.3.1
      • tiff-3.8.2-141.169.3.1
    • SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):
      • libtiff3-32bit-3.8.2-141.169.3.1
    • SUSE Linux Enterprise Server 11-SP4 (ia64):
      • libtiff3-x86-3.8.2-141.169.3.1
    • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
      • tiff-debuginfo-3.8.2-141.169.3.1
      • tiff-debugsource-3.8.2-141.169.3.1

    References: