[SECURITY] [DSA 4349-1] tiff security update

2018-11-3022:41:54

lists.debian.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.2%

JSON

Debian Security Advisory DSA-4349-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
November 30, 2018 https://www.debian.org/security/faq

Package : tiff
CVE ID : CVE-2017-11613 CVE-2017-17095 CVE-2018-5784
CVE-2018-7456 CVE-2018-8905 CVE-2018-10963
CVE-2018-17101 CVE-2018-18557 CVE-2018-15209
CVE-2018-16335

Multiple vulnerabilities have been discovered in the libtiff library and
the included tools, which may result in denial of service or the
execution of arbitrary code if malformed image files are processed.

For the stable distribution (stretch), these problems have been fixed in
version 4.0.8-2+deb9u4.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tiff

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9i386libtiff5-dev< 4.0.8-2+deb9u4libtiff5-dev_4.0.8-2+deb9u4_i386.deb
Debian9mipslibtiff5-dbgsym< 4.0.8-2+deb9u4libtiff5-dbgsym_4.0.8-2+deb9u4_mips.deb
Debian9alllibtiff-doc< 4.0.8-2+deb9u4libtiff-doc_4.0.8-2+deb9u4_all.deb
Debian9mipsellibtiff-tools< 4.0.8-2+deb9u4libtiff-tools_4.0.8-2+deb9u4_mipsel.deb
Debian7armhflibtiff-opengl< 4.0.2-6+deb7u21libtiff-opengl_4.0.2-6+deb7u21_armhf.deb
Debian9amd64libtiff5< 4.0.8-2+deb9u4libtiff5_4.0.8-2+deb9u4_amd64.deb
Debian9armellibtiffxx5< 4.0.8-2+deb9u4libtiffxx5_4.0.8-2+deb9u4_armel.deb
Debian8i386libtiffxx5< 4.0.3-12.3+deb8u6libtiffxx5_4.0.3-12.3+deb8u6_i386.deb
Debian9armhflibtiffxx5-dbgsym< 4.0.8-2+deb9u4libtiffxx5-dbgsym_4.0.8-2+deb9u4_armhf.deb
Debian7i386libtiff-tools< 4.0.2-6+deb7u21libtiff-tools_4.0.2-6+deb7u21_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	i386	libtiff5-dev	< 4.0.8-2+deb9u4	libtiff5-dev_4.0.8-2+deb9u4_i386.deb
Debian	9	mips	libtiff5-dbgsym	< 4.0.8-2+deb9u4	libtiff5-dbgsym_4.0.8-2+deb9u4_mips.deb
Debian	9	all	libtiff-doc	< 4.0.8-2+deb9u4	libtiff-doc_4.0.8-2+deb9u4_all.deb
Debian	9	mipsel	libtiff-tools	< 4.0.8-2+deb9u4	libtiff-tools_4.0.8-2+deb9u4_mipsel.deb
Debian	7	armhf	libtiff-opengl	< 4.0.2-6+deb7u21	libtiff-opengl_4.0.2-6+deb7u21_armhf.deb
Debian	9	amd64	libtiff5	< 4.0.8-2+deb9u4	libtiff5_4.0.8-2+deb9u4_amd64.deb
Debian	9	armel	libtiffxx5	< 4.0.8-2+deb9u4	libtiffxx5_4.0.8-2+deb9u4_armel.deb
Debian	8	i386	libtiffxx5	< 4.0.3-12.3+deb8u6	libtiffxx5_4.0.3-12.3+deb8u6_i386.deb
Debian	9	armhf	libtiffxx5-dbgsym	< 4.0.8-2+deb9u4	libtiffxx5-dbgsym_4.0.8-2+deb9u4_armhf.deb
Debian	7	i386	libtiff-tools	< 4.0.2-6+deb7u21	libtiff-tools_4.0.2-6+deb7u21_i386.deb