The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service
    (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a
    TIFFTAG_JPEGTABLES of length one. (CVE-2016-9453)

  - LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a
    crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2)
    compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in
    tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5)
    tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7)
    TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. (CVE-2014-8127)

  - Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to
    cause a denial of service (application crash) via a crafted GIF file. (CVE-2016-3186)

  - The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw"
    option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP
    image. (CVE-2016-3621)

  - The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote
    attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. (CVE-2016-3622)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the -c lzw     option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP     image. (CVE-2016-3621)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for tiff fixes the following issues :

Security issues fixed :

CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672).

CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257).

CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322).

CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080).

CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186).

CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163).

CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440).

CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448).

CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447)

CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446)

CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461).

Non-security issues fixed: asan_build: build ASAN included

debug_build: build more suitable for debugging

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-16 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libTIFF. Please review       the CVE identifier and bug reports referenced for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       image file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Version 4.0.2-6+deb7u7 introduced changes that resulted in libtiff being unable to write out tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image.

This problem manifested itself with errors like those: $ tiffcp -r 16
-c jpeg sample.tif out.tif _TIFFVGetField: out.tif: Invalid tag 'Predictor' (not supported by codec). _TIFFVGetField: out.tif: Invalid tag 'BadFaxLines' (not supported by codec). tiffcp:
tif_dirwrite.c:687: TIFFWriteDirectorySec: Assertion `0' failed.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u10.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
435806	Alpine: tiff: security update to 4.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
435806	Alpine: tiff: security update to 4.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
219601	Linux Distros Unpatched Vulnerability : CVE-2016-3621	Nessus	Misc.	high
407363	Alpine: tiff: security update to 4.0.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407363	Alpine: tiff: security update to 4.0.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
119143	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:3879-1)	Nessus	SuSE Local Security Checks	critical
96373	GLSA-201701-16 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
94474	Debian DLA-693-2 : tiff regression update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-3621

high

Tenable Plugins

high

high

high

high

high

critical

critical

critical