Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

openSUSE Leap 15.0: 2018:3370-1 Moderate: TIFF Denial of Service Issues

opensuse
Calendar Grey October 24, 2018
Dist Opensuse Esm H88
Important openSUSE patch for libjpeg resolves various vulnerabilities, improving overall system integrity and performance.
An update that fixes 5 vulnerabilities is now available.

Description

This update for tiff fixes the following issues:

Security issue fixed:

- CVE-2018-10779: TIFFWriteScanline in tif_write.c had a heap-based buffer

over-read, as demonstrated by bmp2tiff.(bsc#1092480)

- CVE-2018-17100: There is a int32 overflow in multiply_ms in

tools/ppm2tiff.c, which can cause a denial of service (crash) or

possibly have unspecified other impact via a crafted image file.

(bsc#1108637)

- CVE-2018-17101: There are two out-of-bounds writes in cpTags in

tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service

(application crash) or possibly have unspecified other impact via a

crafted image file. (bsc#1108627)

- CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote

attackers to cause a denial of service (heap-based buffer overflow and

application crash) or possibly have unspecified other impact via a

crafted TIFF file, a similar issue to CVE-2017-9935. (bsc#1110358)

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow moderate severity TIFF openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-1242=1

Package List

- openSUSE Leap 15.0 (i586 x86_64):

libtiff-devel-4.0.9-lp150.4.6.1

libtiff5-4.0.9-lp150.4.6.1

libtiff5-debuginfo-4.0.9-lp150.4.6.1

tiff-4.0.9-lp150.4.6.1

tiff-debuginfo-4.0.9-lp150.4.6.1

tiff-debugsource-4.0.9-lp150.4.6.1

- openSUSE Leap 15.0 (x86_64):

libtiff-devel-32bit-4.0.9-lp150.4.6.1

libtiff5-32bit-4.0.9-lp150.4.6.1

libtiff5-32bit-debuginfo-4.0.9-lp150.4.6.1

References

https://www.suse.com/security/cve/CVE-2018-10779.html

https://www.suse.com/security/cve/CVE-2018-16335.html

https://www.suse.com/security/cve/CVE-2018-17100.html

https://www.suse.com/security/cve/CVE-2018-17101.html

https://www.suse.com/security/cve/CVE-2018-17795.html

https://bugzilla.suse.com/1092480

https://bugzilla.suse.com/1106853

https://bugzilla.suse.com/1108627

https://bugzilla.suse.com/1108637

https://bugzilla.suse.com/1110358

--

Announcement ID: openSUSE-SU-2018:3370-1
Rating: moderate
Affected Products: openSUSE Leap 15.0

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow moderate severity TIFF openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.