Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 591
Alerts This Week
Warning Icon 1 591

openSUSE 42.3: 2018:3371-1 Moderate: TIFF Denial Of Service Fix

opensuse
Calendar Grey October 24, 2018
Dist Opensuse Esm H88
This release tackles five security flaws in png, enhancing overall protection and robustness for Fedora users.
An update that fixes 6 vulnerabilities is now available.

Description

This update for tiff fixes the following issues:

- CVE-2018-17100: There is a int32 overflow in multiply_ms in

tools/ppm2tiff.c, which can cause a denial of service (crash) or

possibly have unspecified other impact via a crafted image file.

(bsc#1108637)

- CVE-2018-17101: There are two out-of-bounds writes in cpTags in

tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service

(application crash) or possibly have unspecified other impact via a

crafted image file. (bsc#1108627)

- CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote

attackers to cause a denial of service (heap-based buffer overflow and

application crash) or possibly have unspecified other impact via a

crafted TIFF file, a similar issue to CVE-2017-9935. (bsc#1110358)

- CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in

tif_dirread.c allowed remote attackers to cause a denial of service

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service security update moderate severity vulnerability openSUSE tiff

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1249=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

libtiff-devel-4.0.9-37.1

libtiff5-4.0.9-37.1

libtiff5-debuginfo-4.0.9-37.1

tiff-4.0.9-37.1

tiff-debuginfo-4.0.9-37.1

tiff-debugsource-4.0.9-37.1

- openSUSE Leap 42.3 (x86_64):

libtiff-devel-32bit-4.0.9-37.1

libtiff5-32bit-4.0.9-37.1

libtiff5-debuginfo-32bit-4.0.9-37.1

References

https://www.suse.com/security/cve/CVE-2017-11613.html

https://www.suse.com/security/cve/CVE-2017-9935.html

https://www.suse.com/security/cve/CVE-2018-16335.html

https://www.suse.com/security/cve/CVE-2018-17100.html

https://www.suse.com/security/cve/CVE-2018-17101.html

https://www.suse.com/security/cve/CVE-2018-17795.html

https://bugzilla.suse.com/1106853

https://bugzilla.suse.com/1108627

https://bugzilla.suse.com/1108637

https://bugzilla.suse.com/1110358

--

Announcement ID: openSUSE-SU-2018:3371-1
Rating: moderate
Affected Products: openSUSE Leap 42.3

Topics%20covered

Topics Covered

security advisory denial of service security update moderate severity vulnerability openSUSE tiff

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.