Ubuntu 14.10: USN-2553-2 Critical: LibTIFF Denial of Service

ubuntu

April 1, 2015

USN-2553-1 introduced a regression in LibTIFF.

Summary

USN-2553-1 introduced a regression in LibTIFF.

Software Description:

- tiff: Tag Image File Format (TIFF) library

Details:

USN-2553-1 fixed vulnerabilities in LibTIFF. One of the security fixes

caused a regression when saving certain TIFF files with a Predictor tag.

The problematic patch has been temporarily backed out until a more complete

fix is available.

We apologize for the inconvenience.

Original advisory details:

William Robinet discovered that LibTIFF incorrectly handled certain

malformed images. If a user or automated system were tricked into opening a

specially crafted image, a remote attacker could crash the application,

leading to a denial of service, or possibly execute arbitrary code with

user privileges. (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129,

CVE-2014-8130)

Paris Zoumpouloglou discovered that LibTIFF incorrectly handled certain

malformed BMP images. If a user or automated system were tricked into

opening a specially cra...

Read the Full Advisory

Topics Covered

security advisory denial of service software fix ubuntu libtiff regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libtiff5                        4.0.3-10ubuntu0.2

Ubuntu 14.04 LTS:
  libtiff5                        4.0.3-7ubuntu0.3

Ubuntu 12.04 LTS:
  libtiff4                        3.9.5-2ubuntu1.8

Ubuntu 10.04 LTS:
  libtiff4                        3.9.2-2ubuntu0.16

In general, a standard system update will make all the necessary changes.