[SECURITY] [DLA 1206-1] tiff security update

2017-12-1306:00:09

lists.debian.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

75.1%

JSON

Package : tiff
Version : 4.0.2-6+deb7u17
CVE ID : CVE-2017-9935
Debian Bug : 866109

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf
function in tools/tiff2pdf.c. This heap overflow could lead to different
damages. For example, a crafted TIFF document can lead to an out-of-bounds read
in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in
t2p_readwrite_pdf_image, or a double free in t2p_free. Given these
possibilities, it probably could cause arbitrary code execution.

This overflow is linked to an underlying assumption that all pages in a tiff
document will have the same transfer function. There is nothing in the tiff
standard that says this needs to be the case.

For Debian 7 "Wheezy", these problems have been fixed in version
4.0.2-6+deb7u17.

We recommend that you upgrade your tiff packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9arm64libtiff5-dev< 4.0.8-2+deb9u2libtiff5-dev_4.0.8-2+deb9u2_arm64.deb
Debian9ppc64ellibtiff-opengl< 4.0.8-2+deb9u2libtiff-opengl_4.0.8-2+deb9u2_ppc64el.deb
Debian7armellibtiff5< 4.0.2-6+deb7u17libtiff5_4.0.2-6+deb7u17_armel.deb
Debian8alltiff< 4.0.3-12.3+deb8u5tiff_4.0.3-12.3+deb8u5_all.deb
Debian9mips64ellibtiff-tools< 4.0.8-2+deb9u2libtiff-tools_4.0.8-2+deb9u2_mips64el.deb
Debian8mipslibtiffxx5< 4.0.3-12.3+deb8u5libtiffxx5_4.0.3-12.3+deb8u5_mips.deb
Debian8mipsellibtiff5< 4.0.3-12.3+deb8u5libtiff5_4.0.3-12.3+deb8u5_mipsel.deb
Debian8ppc64ellibtiff-opengl< 4.0.3-12.3+deb8u5libtiff-opengl_4.0.3-12.3+deb8u5_ppc64el.deb
Debian7i386libtiff5< 4.0.2-6+deb7u17libtiff5_4.0.2-6+deb7u17_i386.deb
Debian8amd64libtiff-tools< 4.0.3-12.3+deb8u5libtiff-tools_4.0.3-12.3+deb8u5_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	libtiff5-dev	< 4.0.8-2+deb9u2	libtiff5-dev_4.0.8-2+deb9u2_arm64.deb
Debian	9	ppc64el	libtiff-opengl	< 4.0.8-2+deb9u2	libtiff-opengl_4.0.8-2+deb9u2_ppc64el.deb
Debian	7	armel	libtiff5	< 4.0.2-6+deb7u17	libtiff5_4.0.2-6+deb7u17_armel.deb
Debian	8	all	tiff	< 4.0.3-12.3+deb8u5	tiff_4.0.3-12.3+deb8u5_all.deb
Debian	9	mips64el	libtiff-tools	< 4.0.8-2+deb9u2	libtiff-tools_4.0.8-2+deb9u2_mips64el.deb
Debian	8	mips	libtiffxx5	< 4.0.3-12.3+deb8u5	libtiffxx5_4.0.3-12.3+deb8u5_mips.deb
Debian	8	mipsel	libtiff5	< 4.0.3-12.3+deb8u5	libtiff5_4.0.3-12.3+deb8u5_mipsel.deb
Debian	8	ppc64el	libtiff-opengl	< 4.0.3-12.3+deb8u5	libtiff-opengl_4.0.3-12.3+deb8u5_ppc64el.deb
Debian	7	i386	libtiff5	< 4.0.2-6+deb7u17	libtiff5_4.0.2-6+deb7u17_i386.deb
Debian	8	amd64	libtiff-tools	< 4.0.3-12.3+deb8u5	libtiff-tools_4.0.3-12.3+deb8u5_amd64.deb