Lucene search

DebianDEBIAN:DLA-880-1:F32BA

HistoryMar 30, 2017 - 7:36 p.m.

[SECURITY] [DLA 880-1] tiff3 security update

2017-03-3019:36:30

lists.debian.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.035 Low

EPSS

Percentile

91.5%

JSON

Package : tiff3
Version : 3.9.6-11+deb7u4
CVE ID : CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 CVE-2015-8784
CVE-2016-9533 CVE-2016-9534 CVE-2016-9535

tiff3 is affected by multiple issues that can result at least in denial of
services of applications using libtiff4. Crafted TIFF files can be
provided to trigger: abort() calls via failing assertions, buffer overruns
(both in read and write mode).

CVE-2015-8781

tif_luv.c in libtiff allows attackers to cause a denial of service
(out-of-bounds write) via an invalid number of samples per pixel in a
LogL compressed TIFF image.

CVE-2015-8782

tif_luv.c in libtiff allows attackers to cause a denial of service
(out-of-bounds writes) via a crafted TIFF image.

CVE-2015-8783

tif_luv.c in libtiff allows attackers to cause a denial of service
(out-of-bounds reads) via a crafted TIFF image.

CVE-2015-8784

The NeXTDecode function in tif_next.c in LibTIFF allows remote
attackers to cause a denial of service (out-of-bounds write) via a
crafted TIFF image.

CVE-2016-9533

tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write
vulnerabilities in heap allocated buffers.

CVE-2016-9534

tif_write.c in libtiff 4.0.6 has an issue in the error code path of
TIFFFlushData1() that didn&#x27;t reset the tif_rawcc and tif_rawcp
members.

CVE-2016-9535

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions
that can lead to assertion failures in debug mode, or buffer
overflows in release mode, when dealing with unusual tile size
like YCbCr with subsampling.

For Debian 7 "Wheezy", these problems have been fixed in version
3.9.6-11+deb7u4.

We recommend that you upgrade your tiff3 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

–
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-amd64libtiff5-dev< 4.0.3-12.3+deb8u1libtiff5-dev_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian7i386libtiffxx0c2< 3.9.6-11+deb7u4libtiffxx0c2_3.9.6-11+deb7u4_i386.deb
Debian7kfreebsd-amd64libtiff5< 4.0.2-6+deb7u5libtiff5_4.0.2-6+deb7u5_kfreebsd-amd64.deb
Debian7powerpclibtiff-tools< 4.0.2-6+deb7u5libtiff-tools_4.0.2-6+deb7u5_powerpc.deb
Debian8alltiff< 4.0.3-12.3+deb8u1tiff_4.0.3-12.3+deb8u1_all.deb
Debian8armhflibtiff5-dev< 4.0.3-12.3+deb8u1libtiff5-dev_4.0.3-12.3+deb8u1_armhf.deb
Debian6amd64libtiff4-dev< 3.9.4-5+squeeze14libtiff4-dev_3.9.4-5+squeeze14_amd64.deb
Debian7armellibtiff-tools< 4.0.2-6+deb7u5libtiff-tools_4.0.2-6+deb7u5_armel.deb
Debian7armellibtiff4< 3.9.6-11+deb7u4libtiff4_3.9.6-11+deb7u4_armel.deb
Debian7alllibtiff-doc< 4.0.2-6+deb7u5libtiff-doc_4.0.2-6+deb7u5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-amd64	libtiff5-dev	< 4.0.3-12.3+deb8u1	libtiff5-dev_4.0.3-12.3+deb8u1_kfreebsd-amd64.deb
Debian	7	i386	libtiffxx0c2	< 3.9.6-11+deb7u4	libtiffxx0c2_3.9.6-11+deb7u4_i386.deb
Debian	7	kfreebsd-amd64	libtiff5	< 4.0.2-6+deb7u5	libtiff5_4.0.2-6+deb7u5_kfreebsd-amd64.deb
Debian	7	powerpc	libtiff-tools	< 4.0.2-6+deb7u5	libtiff-tools_4.0.2-6+deb7u5_powerpc.deb
Debian	8	all	tiff	< 4.0.3-12.3+deb8u1	tiff_4.0.3-12.3+deb8u1_all.deb
Debian	8	armhf	libtiff5-dev	< 4.0.3-12.3+deb8u1	libtiff5-dev_4.0.3-12.3+deb8u1_armhf.deb
Debian	6	amd64	libtiff4-dev	< 3.9.4-5+squeeze14	libtiff4-dev_3.9.4-5+squeeze14_amd64.deb
Debian	7	armel	libtiff-tools	< 4.0.2-6+deb7u5	libtiff-tools_4.0.2-6+deb7u5_armel.deb
Debian	7	armel	libtiff4	< 3.9.6-11+deb7u4	libtiff4_3.9.6-11+deb7u4_armel.deb
Debian	7	all	libtiff-doc	< 4.0.2-6+deb7u5	libtiff-doc_4.0.2-6+deb7u5_all.deb