[SECURITY] [DLA 405-1] tiff security update

2016-01-3013:24:07

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.035

Percentile

91.6%

JSON

Package : tiff
Version : 3.9.4-5+squeeze14
CVE ID : CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 CVE-2015-8784
Debian Bug :

Several security flaws have been found and solved in libtiff, a
library that provides support for handling Tag Image File Format
(TIFF). These flaws concern out of bounds reads and writes in the
LogL16Decode, LogLuvDecode24, LogLuvDecode32, LogLuvDecodeTile,
LogL16Encode, LogLuvEncode24, LogLuvEncode32 and NeXTDecode functions.

These IDs were assigned for the problems: CVE-2015-8781,
CVE-2015-8782, CVE-2015-8783 and CVE-2015-8784.

For Debian 6 "Squeeze", these issues have been fixed in tiff version
3.9.4-5+squeeze14. We recommend you to upgrade your tiff packages.

Learn more about the Debian Long Term Support (LTS) Project and how to
apply these updates at: https://wiki.debian.org/LTS/
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian7armellibtiff-tools< 4.0.2-6+deb7u5libtiff-tools_4.0.2-6+deb7u5_armel.deb
Debian8kfreebsd-amd64libtiff5-dev< 4.0.3-12.3+deb8u1libtiff5-dev_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian8mipslibtiff-opengl< 4.0.3-12.3+deb8u1libtiff-opengl_4.0.3-12.3+deb8u1_mips.deb
Debian7sparclibtiff-opengl< 4.0.2-6+deb7u5libtiff-opengl_4.0.2-6+deb7u5_sparc.deb
Debian8armhflibtiff-tools< 4.0.3-12.3+deb8u1libtiff-tools_4.0.3-12.3+deb8u1_armhf.deb
Debian7i386libtiff5< 4.0.2-6+deb7u5libtiff5_4.0.2-6+deb7u5_i386.deb
Debian8kfreebsd-amd64libtiff5< 4.0.3-12.3+deb8u1libtiff5_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian7s390xlibtiff-opengl< 4.0.2-6+deb7u5libtiff-opengl_4.0.2-6+deb7u5_s390x.deb
Debian8amd64libtiffxx5< 4.0.3-12.3+deb8u1libtiffxx5_4.0.3-12.3+deb8u1_amd64.deb
Debian7armellibtiff5< 4.0.2-6+deb7u5libtiff5_4.0.2-6+deb7u5_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	armel	libtiff-tools	< 4.0.2-6+deb7u5	libtiff-tools_4.0.2-6+deb7u5_armel.deb
Debian	8	kfreebsd-amd64	libtiff5-dev	< 4.0.3-12.3+deb8u1	libtiff5-dev_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian	8	mips	libtiff-opengl	< 4.0.3-12.3+deb8u1	libtiff-opengl_4.0.3-12.3+deb8u1_mips.deb
Debian	7	sparc	libtiff-opengl	< 4.0.2-6+deb7u5	libtiff-opengl_4.0.2-6+deb7u5_sparc.deb
Debian	8	armhf	libtiff-tools	< 4.0.3-12.3+deb8u1	libtiff-tools_4.0.3-12.3+deb8u1_armhf.deb
Debian	7	i386	libtiff5	< 4.0.2-6+deb7u5	libtiff5_4.0.2-6+deb7u5_i386.deb
Debian	8	kfreebsd-amd64	libtiff5	< 4.0.3-12.3+deb8u1	libtiff5_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian	7	s390x	libtiff-opengl	< 4.0.2-6+deb7u5	libtiff-opengl_4.0.2-6+deb7u5_s390x.deb
Debian	8	amd64	libtiffxx5	< 4.0.3-12.3+deb8u1	libtiffxx5_4.0.3-12.3+deb8u1_amd64.deb
Debian	7	armel	libtiff5	< 4.0.2-6+deb7u5	libtiff5_4.0.2-6+deb7u5_armel.deb