SUSE-SU-2016:3301-1

    Dashboard / Vulnerabilities / SUSE-SU-2016:3301-1

    SUSE-SU-2016:3301-1

    Published: 29 Dec 2016Last Modified: 4 Feb 2026

    Summary: Security update for tiff

    Details: The tiff library and tools were updated to version 4.0.7 fixing various bug and security issues. - CVE-2014-8127: out-of-bounds read with malformed TIFF image in multiple tools [bnc#914890] - CVE-2016-9297: tif_dirread.c read outside buffer in _TIFFPrintField() [bnc#1010161] - CVE-2016-3658: Illegal read in TIFFWriteDirectoryTagLongLong8Array function in tiffset / tif_dirwrite.c [bnc#974840] - CVE-2016-9273: heap overflow [bnc#1010163] - CVE-2016-3622: divide By Zero in the tiff2rgba tool [bnc#974449] - CVE-2016-5652: tiff2pdf JPEG Compression Tables Heap Buffer Overflow [bnc#1007280] - CVE-2016-9453: out-of-bounds Write memcpy and less bound check in tiff2pdf [bnc#1011107] - CVE-2016-5875: heap-based buffer overflow when using the PixarLog compressionformat [bnc#987351] - CVE-2016-9448: regression introduced by fixing CVE-2016-9297 [bnc#1011103] - CVE-2016-5321: out-of-bounds read in tiffcrop / DumpModeDecode() function [bnc#984813] - CVE-2016-5323: Divide-by-zero in _TIFFFax3fillruns() function (null ptr dereference?) [bnc#984815]

    References: https://www.suse.com/support/update/announcement/2016/suse-su-20163301-1/, https://bugzilla.suse.com/1007280, https://bugzilla.suse.com/1010161, https://bugzilla.suse.com/1010163, https://bugzilla.suse.com/1011103, https://bugzilla.suse.com/1011107, https://bugzilla.suse.com/914890, https://bugzilla.suse.com/974449, https://bugzilla.suse.com/974840, https://bugzilla.suse.com/984813, https://bugzilla.suse.com/984815, https://bugzilla.suse.com/987351, https://www.suse.com/security/cve/CVE-2014-8127, https://www.suse.com/security/cve/CVE-2016-3622, https://www.suse.com/security/cve/CVE-2016-3658, https://www.suse.com/security/cve/CVE-2016-5321, https://www.suse.com/security/cve/CVE-2016-5323, https://www.suse.com/security/cve/CVE-2016-5652, https://www.suse.com/security/cve/CVE-2016-5875, https://www.suse.com/security/cve/CVE-2016-9273, https://www.suse.com/security/cve/CVE-2016-9297, https://www.suse.com/security/cve/CVE-2016-9448, https://www.suse.com/security/cve/CVE-2016-9453

    Affected packages

    Package

    Name: tiff

    Purl: pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.0.7-35.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High