SUSE-SU-2018:1472-1

Dashboard / Vulnerabilities / SUSE-SU-2018:1472-1

SUSE-SU-2018:1472-1

Summary: Security update for tiff

Details: This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-5315: The setByteArray function in tif_dir.c allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image. (bsc#984809) - CVE-2016-10267: LibTIFF allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8. (bsc#1017694) - CVE-2016-10269: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 512' and libtiff/tif_unix.c:340:2. (bsc#1031254) - CVE-2016-10270: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 8' and libtiff/tif_read.c:523:22. (bsc#1031250) - CVE-2017-18013: In LibTIFF, there was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. (bsc#1074317) - CVE-2017-7593: tif_read.c did not ensure that tif_rawdata is properly initialized, which might have allowed remote attackers to obtain sensitive information from process memory via a crafted image. (bsc#1033129) - CVE-2017-7595: The JPEGSetupEncode function in tiff_jpeg.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. (bsc#1033127) - CVE-2017-7596: LibTIFF had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033126) - CVE-2017-7597: tif_dirread.c had an 'outside the range of representable values of type float' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033120) - CVE-2017-7599: LibTIFF had an 'outside the range of representable values of type short' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033113) - CVE-2017-7600: LibTIFF had an 'outside the range of representable values of type unsigned char' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033112) - CVE-2017-7601: LibTIFF had a 'shift exponent too large for 64-bit type long' undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033111) - CVE-2017-7602: LibTIFF had a signed integer overflow, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033109) - Multiple divide by zero issues - CVE-2016-5314: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr. (bsc#987351 bsc#984808 bsc#984831)

References: https://www.suse.com/support/update/announcement/2018/suse-su-20181472-1/, https://bugzilla.suse.com/1017694, https://bugzilla.suse.com/1031250, https://bugzilla.suse.com/1031254, https://bugzilla.suse.com/1033109, https://bugzilla.suse.com/1033111, https://bugzilla.suse.com/1033112, https://bugzilla.suse.com/1033113, https://bugzilla.suse.com/1033120, https://bugzilla.suse.com/1033126, https://bugzilla.suse.com/1033127, https://bugzilla.suse.com/1033129, https://bugzilla.suse.com/1074317, https://bugzilla.suse.com/984808, https://bugzilla.suse.com/984809, https://bugzilla.suse.com/984831, https://bugzilla.suse.com/987351, https://www.suse.com/security/cve/CVE-2016-10267, https://www.suse.com/security/cve/CVE-2016-10269, https://www.suse.com/security/cve/CVE-2016-10270, https://www.suse.com/security/cve/CVE-2016-5314, https://www.suse.com/security/cve/CVE-2016-5315, https://www.suse.com/security/cve/CVE-2017-18013, https://www.suse.com/security/cve/CVE-2017-7593, https://www.suse.com/security/cve/CVE-2017-7595, https://www.suse.com/security/cve/CVE-2017-7596, https://www.suse.com/security/cve/CVE-2017-7597, https://www.suse.com/security/cve/CVE-2017-7599, https://www.suse.com/security/cve/CVE-2017-7600, https://www.suse.com/security/cve/CVE-2017-7601, https://www.suse.com/security/cve/CVE-2017-7602