openSUSE Security Update: Security update for tiff
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1834-1
Rating:             moderate
References:         #1007276 #1074317 #1082332 #1082825 #1086408 
                    #1092949 #974621 
Cross-References:   CVE-2016-3632 CVE-2016-8331 CVE-2017-11613
                    CVE-2017-13726 CVE-2017-18013 CVE-2018-10963
                    CVE-2018-7456 CVE-2018-8905
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:

   This update for tiff fixes the following issues:

   These security issues were fixed:

   - CVE-2017-18013: There was a Null-Pointer Dereference in the tif_print.c
     TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
     (bsc#1074317)
   - CVE-2018-10963: The TIFFWriteDirectorySec() function in tif_dirwrite.c
     allowed remote attackers to cause a denial of service (assertion failure
     and application crash) via a crafted file, a different vulnerability
     than CVE-2017-13726.  (bsc#1092949)
   - CVE-2018-7456: Prevent a NULL Pointer dereference in the function
     TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF
     information, a different vulnerability than CVE-2017-18013 (bsc#1082825)
   - CVE-2017-11613: Prevent denial of service in the TIFFOpen function.
     During the TIFFOpen process, td_imagelength is not checked. The value of
     td_imagelength can be directly controlled by an input file. In the
     ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is
     called based on td_imagelength. If the value of td_imagelength is set
     close to the amount of system memory, it will hang the system or trigger
     the OOM killer (bsc#1082332)
   - CVE-2018-8905: Prevent heap-based buffer overflow in the function
     LZWDecodeCompat via a crafted TIFF file (bsc#1086408)
   - CVE-2016-8331: Prevent remote code execution because of incorrect
     handling of TIFF images. A crafted TIFF document could have lead to a
     type confusion vulnerability resulting in remote code execution. This
     vulnerability could have been be triggered via a TIFF file delivered to
     the application using LibTIFF's tag extension functionality
 (bsc#1007276)
   - CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to
     cause a denial of service (out-of-bounds write) or execute arbitrary
     code via a crafted TIFF image (bsc#974621)

   This update was imported from the SUSE:SLE-12:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended
 installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-677=1



Package List:

   - openSUSE Leap 42.3 (i586 x86_64):

      libtiff-devel-4.0.9-31.1
      libtiff5-4.0.9-31.1
      libtiff5-debuginfo-4.0.9-31.1
      tiff-4.0.9-31.1
      tiff-debuginfo-4.0.9-31.1
      tiff-debugsource-4.0.9-31.1

   - openSUSE Leap 42.3 (x86_64):

      libtiff-devel-32bit-4.0.9-31.1
      libtiff5-32bit-4.0.9-31.1
      libtiff5-debuginfo-32bit-4.0.9-31.1


References:

   https://www.suse.com/security/cve/CVE-2016-3632.html
   https://www.suse.com/security/cve/CVE-2016-8331.html
   https://www.suse.com/security/cve/CVE-2017-11613.html
   https://www.suse.com/security/cve/CVE-2017-13726.html
   https://www.suse.com/security/cve/CVE-2017-18013.html
   https://www.suse.com/security/cve/CVE-2018-10963.html
   https://www.suse.com/security/cve/CVE-2018-7456.html
   https://www.suse.com/security/cve/CVE-2018-8905.html
   https://bugzilla.suse.com/1007276
   https://bugzilla.suse.com/1074317
   https://bugzilla.suse.com/1082332
   https://bugzilla.suse.com/1082825
   https://bugzilla.suse.com/1086408
   https://bugzilla.suse.com/1092949
   https://bugzilla.suse.com/974621

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org