Security update for tiff SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:3370-1 Final 1 1 2018-10-24T08:56:52Z current 2018-10-24T08:56:52Z 2018-10-24T08:56:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: Security issue fixed: - CVE-2018-10779: TIFFWriteScanline in tif_write.c had a heap-based buffer over-read, as demonstrated by bmp2tiff.(bsc#1092480) - CVE-2018-17100: There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108637) - CVE-2018-17101: There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108627) - CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. (bsc#1110358) - CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. (bsc#1106853) This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html E-Mail link for openSUSE-SU-2018:3370-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 libtiff-devel-4.0.9-lp150.4.6.1 libtiff-devel-32bit-4.0.9-lp150.4.6.1 libtiff5-4.0.9-lp150.4.6.1 libtiff5-32bit-4.0.9-lp150.4.6.1 tiff-4.0.9-lp150.4.6.1 libtiff-devel-4.0.9-lp150.4.6.1 as a component of openSUSE Leap 15.0 libtiff-devel-32bit-4.0.9-lp150.4.6.1 as a component of openSUSE Leap 15.0 libtiff5-4.0.9-lp150.4.6.1 as a component of openSUSE Leap 15.0 libtiff5-32bit-4.0.9-lp150.4.6.1 as a component of openSUSE Leap 15.0 tiff-4.0.9-lp150.4.6.1 as a component of openSUSE Leap 15.0 TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. CVE-2018-10779 openSUSE Leap 15.0:libtiff-devel-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff-devel-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:tiff-4.0.9-lp150.4.6.1 low Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html https://www.suse.com/security/cve/CVE-2018-10779.html CVE-2018-10779 https://bugzilla.suse.com/1092480 SUSE Bug 1092480 newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. CVE-2018-16335 openSUSE Leap 15.0:libtiff-devel-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff-devel-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:tiff-4.0.9-lp150.4.6.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html https://www.suse.com/security/cve/CVE-2018-16335.html CVE-2018-16335 https://bugzilla.suse.com/1106853 SUSE Bug 1106853 An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. CVE-2018-17100 openSUSE Leap 15.0:libtiff-devel-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff-devel-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:tiff-4.0.9-lp150.4.6.1 low Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html https://www.suse.com/security/cve/CVE-2018-17100.html CVE-2018-17100 https://bugzilla.suse.com/1108637 SUSE Bug 1108637 An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. CVE-2018-17101 openSUSE Leap 15.0:libtiff-devel-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff-devel-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:tiff-4.0.9-lp150.4.6.1 low Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html https://www.suse.com/security/cve/CVE-2018-17101.html CVE-2018-17101 https://bugzilla.suse.com/1108627 SUSE Bug 1108627 The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. CVE-2018-17795 openSUSE Leap 15.0:libtiff-devel-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff-devel-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-32bit-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:libtiff5-4.0.9-lp150.4.6.1 openSUSE Leap 15.0:tiff-4.0.9-lp150.4.6.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00055.html https://www.suse.com/security/cve/CVE-2018-17795.html CVE-2018-17795 https://bugzilla.suse.com/1046077 SUSE Bug 1046077 https://bugzilla.suse.com/1110358 SUSE Bug 1110358