Lucene search

DebianDEBIAN:DLA-2009-1:97403

HistoryNov 26, 2019 - 9:24 p.m.

[SECURITY] [DLA 2009-1] tiff security update

2019-11-2621:24:54

lists.debian.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.005 Low

EPSS

Percentile

75.1%

JSON

Package : tiff
Version : 4.0.3-12.3+deb8u10
CVE ID : CVE-2017-17095 CVE-2018-12900 CVE-2018-18661
CVE-2019-6128 CVE-2019-17546

Several issues have been found in tiff, a Tag Image File Format library.

CVE-2019-17546

 The RGBA interface contains an integer overflow that might lead
 to heap buffer overflow write.

CVE-2019-6128

 A memory leak exists due to missing cleanup code.

CVE-2018-18661

 In case of exhausted memory there is a null pointer dereference
 in tiff2bw.

CVE-2018-12900

 Fix for heap-based buffer overflow, that could be used to crash an
 application or even to execute arbitrary code (with the permission
 of the user running this application).

CVE-2017-17095

 A crafted tiff file could lead to a heap buffer overflow in pal2rgb.

For Debian 8 "Jessie", these problems have been fixed in version
4.0.3-12.3+deb8u10.

We recommend that you upgrade your tiff packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8armhflibtiff5< 4.0.3-12.3+deb8u10libtiff5_4.0.3-12.3+deb8u10_armhf.deb
Debian8i386libtiff-opengl< 4.0.3-12.3+deb8u10libtiff-opengl_4.0.3-12.3+deb8u10_i386.deb
Debian8i386libtiffxx5< 4.0.3-12.3+deb8u10libtiffxx5_4.0.3-12.3+deb8u10_i386.deb
Debian8amd64libtiff-opengl< 4.0.3-12.3+deb8u10libtiff-opengl_4.0.3-12.3+deb8u10_amd64.deb
Debian8armellibtiff-tools< 4.0.3-12.3+deb8u10libtiff-tools_4.0.3-12.3+deb8u10_armel.deb
Debian8armhflibtiff-opengl< 4.0.3-12.3+deb8u10libtiff-opengl_4.0.3-12.3+deb8u10_armhf.deb
Debian8amd64libtiffxx5< 4.0.3-12.3+deb8u10libtiffxx5_4.0.3-12.3+deb8u10_amd64.deb
Debian8i386libtiff-tools< 4.0.3-12.3+deb8u10libtiff-tools_4.0.3-12.3+deb8u10_i386.deb
Debian8armhflibtiff5-dev< 4.0.3-12.3+deb8u10libtiff5-dev_4.0.3-12.3+deb8u10_armhf.deb
Debian8i386libtiff5< 4.0.3-12.3+deb8u10libtiff5_4.0.3-12.3+deb8u10_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	armhf	libtiff5	< 4.0.3-12.3+deb8u10	libtiff5_4.0.3-12.3+deb8u10_armhf.deb
Debian	8	i386	libtiff-opengl	< 4.0.3-12.3+deb8u10	libtiff-opengl_4.0.3-12.3+deb8u10_i386.deb
Debian	8	i386	libtiffxx5	< 4.0.3-12.3+deb8u10	libtiffxx5_4.0.3-12.3+deb8u10_i386.deb
Debian	8	amd64	libtiff-opengl	< 4.0.3-12.3+deb8u10	libtiff-opengl_4.0.3-12.3+deb8u10_amd64.deb
Debian	8	armel	libtiff-tools	< 4.0.3-12.3+deb8u10	libtiff-tools_4.0.3-12.3+deb8u10_armel.deb
Debian	8	armhf	libtiff-opengl	< 4.0.3-12.3+deb8u10	libtiff-opengl_4.0.3-12.3+deb8u10_armhf.deb
Debian	8	amd64	libtiffxx5	< 4.0.3-12.3+deb8u10	libtiffxx5_4.0.3-12.3+deb8u10_amd64.deb
Debian	8	i386	libtiff-tools	< 4.0.3-12.3+deb8u10	libtiff-tools_4.0.3-12.3+deb8u10_i386.deb
Debian	8	armhf	libtiff5-dev	< 4.0.3-12.3+deb8u10	libtiff5-dev_4.0.3-12.3+deb8u10_armhf.deb
Debian	8	i386	libtiff5	< 4.0.3-12.3+deb8u10	libtiff5_4.0.3-12.3+deb8u10_i386.deb