Lucene search

K
mageiaGentoo FoundationMGASA-2018-0493
HistoryDec 30, 2018 - 2:24 a.m.

Updated libtiff packages fix security vulnerabilities

2018-12-3002:24:32
Gentoo Foundation
advisories.mageia.org
10

0.323 Low

EPSS

Percentile

97.0%

Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file. (CVE-2018-12900) LibTIFF 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write. (CVE-2018-18557) In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. (CVE-2018-19210)

OSVersionArchitecturePackageVersionFilename
Mageia6noarchlibtiff< 4.0.9-1.9libtiff-4.0.9-1.9.mga6