This update for tiff fixes the following issues :
Security issues fixed :
CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672).
CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257).
CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322).
CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080).
CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186).
CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163).
CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440).
CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448).
CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447)
CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446)
CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461).
Non-security issues fixed: asan_build: build ASAN included
debug_build: build more suitable for debugging
Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2018:3879-1.
# The text itself is copyright (C) SUSE.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(119143);
script_version("1.5");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/19");
script_cve_id("CVE-2015-8870", "CVE-2016-3619", "CVE-2016-3620", "CVE-2016-3621", "CVE-2016-5319", "CVE-2016-9273", "CVE-2017-17942", "CVE-2017-9117", "CVE-2017-9147", "CVE-2018-12900", "CVE-2018-18661");
script_name(english:"SUSE SLES11 Security Update : tiff (SUSE-SU-2018:3879-1)");
script_summary(english:"Checks rpm output for the updated packages.");
script_set_attribute(
attribute:"synopsis",
value:"The remote SUSE host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"This update for tiff fixes the following issues :
Security issues fixed :
CVE-2018-18661: Fixed NULL pointer dereference in the function
LZWDecode in the file tif_lzw.c (bsc#1113672).
CVE-2018-12900: Fixed heap-based buffer overflow in the
cpSeparateBufToContigBuf (bsc#1099257).
CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in
tif_dir.c, that allowed remote attackers to cause a DoS via acrafted
TIFF file (bsc#1040322).
CVE-2017-9117: Fixed BMP images processing that was verified without
biWidth and biHeight values (bsc#1040080).
CVE-2017-17942: Fixed issue in the function PackBitsEncode that could
have led to a heap overflow and caused a DoS (bsc#1074186).
CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163).
CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode
(bsc#983440).
CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw
packing) (bsc#974448).
CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip
packing) (bsc#974447)
CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none
packing) (bsc#974446)
CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed
remote attackers to causea DOS (bsc#1014461).
Non-security issues fixed: asan_build: build ASAN included
debug_build: build more suitable for debugging
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1010163"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1014461"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1040080"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1040322"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1074186"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1099257"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=1113672"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=974446"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=974447"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=974448"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=983440"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2015-8870/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-3619/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-3620/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-3621/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-5319/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-9273/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-17942/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-9117/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2017-9147/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2018-12900/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2018-18661/"
);
# https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?e798c7ce"
);
script_set_attribute(
attribute:"solution",
value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.
Alternatively you can run the command listed for your product :
SUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t
patch sdksp4-tiff-13878=1
SUSE Linux Enterprise Server 11-SP4:zypper in -t patch
slessp4-tiff-13878=1
SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch
dbgsp4-tiff-13878=1"
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libtiff3");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:tiff");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/10/03");
script_set_attribute(attribute:"patch_publication_date", value:"2018/11/23");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/26");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"SuSE Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES11", "SUSE " + os_ver);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES11" && (! preg(pattern:"^(4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP4", os_ver + " SP" + sp);
flag = 0;
if (rpm_check(release:"SLES11", sp:"4", cpu:"x86_64", reference:"libtiff3-32bit-3.8.2-141.169.22.1")) flag++;
if (rpm_check(release:"SLES11", sp:"4", cpu:"s390x", reference:"libtiff3-32bit-3.8.2-141.169.22.1")) flag++;
if (rpm_check(release:"SLES11", sp:"4", reference:"libtiff3-3.8.2-141.169.22.1")) flag++;
if (rpm_check(release:"SLES11", sp:"4", reference:"tiff-3.8.2-141.169.22.1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
else security_hole(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tiff");
}
Vendor | Product | Version |
---|---|---|
novell | suse_linux | libtiff3 |
novell | suse_linux | tiff |
novell | suse_linux | 11 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8870
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3619
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3620
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3621
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5319
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9273
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17942
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9117
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9147
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12900
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18661
www.nessus.org/u?e798c7ce
bugzilla.suse.com/show_bug.cgi?id=1010163
bugzilla.suse.com/show_bug.cgi?id=1014461
bugzilla.suse.com/show_bug.cgi?id=1040080
bugzilla.suse.com/show_bug.cgi?id=1040322
bugzilla.suse.com/show_bug.cgi?id=1074186
bugzilla.suse.com/show_bug.cgi?id=1099257
bugzilla.suse.com/show_bug.cgi?id=1113672
bugzilla.suse.com/show_bug.cgi?id=974446
bugzilla.suse.com/show_bug.cgi?id=974447
bugzilla.suse.com/show_bug.cgi?id=974448
bugzilla.suse.com/show_bug.cgi?id=983440
www.suse.com/security/cve/CVE-2015-8870/
www.suse.com/security/cve/CVE-2016-3619/
www.suse.com/security/cve/CVE-2016-3620/
www.suse.com/security/cve/CVE-2016-3621/
www.suse.com/security/cve/CVE-2016-5319/
www.suse.com/security/cve/CVE-2016-9273/
www.suse.com/security/cve/CVE-2017-17942/
www.suse.com/security/cve/CVE-2017-9117/
www.suse.com/security/cve/CVE-2017-9147/
www.suse.com/security/cve/CVE-2018-12900/
www.suse.com/security/cve/CVE-2018-18661/