There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2017-16232)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - An out-of-bounds heap read was discovered in libtiff. A     crafted file could cause the application to crash or,     potentially, disclose process memory.(CVE-2016-9297)

  - A heap-based buffer overflow flaw was found within     libtiff's tiff2pdf tool. A remote attacker could     potentially exploit this flaw to execute arbitrary code     by tricking a user into converting a specially crafted     file using the tiff2pdf tool.(CVE-2017-11335)

  - An integer overflow flaw was found in libtiff that     exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a     user opens a crafted TIFF file. The highest threat from     this vulnerability is to confidentiality, integrity, as     well as system availability.(CVE-2020-35523)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - ** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak     vulnerabilities, which allow attackers to cause a     denial of service (memory consumption), as demonstrated     by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third     parties were unable to reproduce the     issue.(CVE-2017-16232)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - LibTIFF 4.0.8 has multiple memory leak vulnerabilities,     which allow attackers to cause a denial of service     (memory consumption), as demonstrated by tif_open.c,     tif_lzw.c, and tif_aux.c. NOTE: Third parties were     unable to reproduce the issue.(CVE-2017-16232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - tools/tiffcrop.c in LibTIFF 4.0.7 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and buffer overflow) or possibly have     unspecified other impact via a crafted TIFF image,     related to 'READ of size 1' and     libtiff/tif_fax3.c:413:13.(CVE-2016-10271)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - LibTIFF 4.0.8 has multiple memory leak vulnerabilities,     which allow attackers to cause a denial of service     (memory consumption), as demonstrated by tif_open.c,     tif_lzw.c, and tif_aux.c. NOTE: Third parties were     unable to reproduce the issue.(CVE-2017-16232)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - tools/tiffcrop.c in LibTIFF 4.0.7 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and buffer overflow) or possibly have     unspecified other impact via a crafted TIFF image,     related to 'READ of size 1' and     libtiff/tif_fax3.c:413:13.(CVE-2016-10271)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - LibTIFF 4.0.8 has multiple memory leak vulnerabilities,     which allow attackers to cause a denial of service     (memory consumption), as demonstrated by tif_open.c,     tif_lzw.c, and tif_aux.c. NOTE: Third parties were     unable to reproduce the issue.(CVE-2017-16232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - LibTIFF 4.0.8 has multiple memory leak vulnerabilities,     which allow attackers to cause a denial of service     (memory consumption), as demonstrated by tif_open.c,     tif_lzw.c, and tif_aux.c. NOTE: Third parties were     unable to reproduce the issue.(CVE-2017-16232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) by setting the tags     TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values     that access 0-byte arrays. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-9297.(CVE-2016-9448)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - tools/tiffcrop.c in LibTIFF 4.0.7 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and buffer overflow) or possibly have     unspecified other impact via a crafted TIFF image,     related to 'READ of size 1' and     libtiff/tif_fax3.c:413:13.(CVE-2016-10271)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

  - CVE-2016-9453: The t2p_readwrite_pdf_image_tile function     allowed remote attackers to cause a denial of service     (out-of-bounds write and crash) or possibly execute     arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES     of length one (bsc#1011107).

  - CVE-2016-5652: An exploitable heap-based buffer overflow     existed in the handling of TIFF images in the TIFF2PDF     tool. A crafted TIFF document can lead to a heap-based     buffer overflow resulting in remote code execution.
    Vulnerability can be triggered via a saved TIFF file     delivered by other means (bsc#1007280).

  - CVE-2017-11335: There is a heap-based buffer overflow in     tools/tiff2pdf.c via a PlanarConfig=Contig image, which     caused a more than one hundred bytes out-of-bounds write     (related to the ZIPDecode function in tif_zip.c). A     crafted input may lead to a remote denial of service     attack or an arbitrary code execution attack     (bsc#1048937).

  - CVE-2016-9536: tools/tiff2pdf.c had an out-of-bounds     write vulnerabilities in heap allocated buffers in     t2p_process_jpeg_strip(). Reported as MSVR 35098, aka     't2p_process_jpeg_strip heap-buffer-overflow.'     (bsc#1011845)

  - CVE-2017-9935: In LibTIFF, there was a heap-based buffer     overflow in the t2p_write_pdf function in     tools/tiff2pdf.c. This heap overflow could lead to     different damages. For example, a crafted TIFF document     can lead to an out-of-bounds read in TIFFCleanup, an     invalid free in TIFFClose or t2p_free, memory corruption     in t2p_readwrite_pdf_image, or a double free in     t2p_free. Given these possibilities, it probably could     cause arbitrary code execution (bsc#1046077).

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2015-7554: The _TIFFVGetField function in tif_dir.c     allowed attackers to cause a denial of service (invalid     memory write and crash) or possibly have unspecified     other impact via crafted field data in an extension tag     in a TIFF image (bsc#960341).

  - CVE-2016-5318: Stack-based buffer overflow in the
    _TIFFVGetField function allowed remote attackers to     crash the application via a crafted tiff (bsc#983436).

  - CVE-2016-10095: Stack-based buffer overflow in the
    _TIFFVGetField function in tif_dir.c allowed remote     attackers to cause a denial of service (crash) via a     crafted TIFF file (bsc#1017690,).

  - CVE-2016-10268: tools/tiffcp.c allowed remote attackers     to cause a denial of service (integer underflow and     heap-based buffer under-read) or possibly have     unspecified other impact via a crafted TIFF image,     related to 'READ of size 78490' and     libtiff/tif_unix.c:115:23 (bsc#1031255)

  - An overlapping of memcpy parameters was fixed which     could lead to content corruption (bsc#1017691).

  - Fixed an invalid memory read which could lead to a crash     (bsc#1017692).

  - Fixed a NULL pointer dereference in TIFFReadRawData     (tiffinfo.c) that could crash the decoder (bsc#1017688).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

A heap based buffer overflow has been discovered in the tiff2pdf utility, part of the Tag Image File Format (TIFF) library.

A PlanarConfig=Contig image can cause an out-of-bounds write (related to the ZIPDecode function). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.

For Debian 7 'Wheezy', these problems have been fixed in version 3.9.6-11+deb7u8.

We recommend that you upgrade your tiff3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Tag Image File Format (TIFF) library and its associated tools.

CVE-2017-11335

A heap based buffer overflow via a PlanarConfig=Contig image, which causes an out-of-bounds write (related to the ZIPDecode function). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.

CVE-2017-12944

A mishandling of memory allocation for short files allows attackers to cause a denial of service (allocation failure and application crash) during a tiff2pdf invocation.

CVE-2017-13726

A reachable assertion abort allows a crafted input to lead to a remote denial of service attack.

CVE-2017-13727

A reachable assertion abort allows a crafted input to lead to a remote denial of service attack.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u16.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151389	EulerOS Virtualization 3.0.2.2 : libtiff (EulerOS-SA-2021-2145)	Nessus	Huawei Local Security Checks	high
151343	EulerOS Virtualization for ARM 64 3.0.2.0 : libtiff (EulerOS-SA-2021-2119)	Nessus	Huawei Local Security Checks	high
147566	EulerOS Virtualization 3.0.2.6 : libtiff (EulerOS-SA-2021-1439)	Nessus	Huawei Local Security Checks	high
147129	EulerOS Virtualization 3.0.6.6 : libtiff (EulerOS-SA-2021-1492)	Nessus	Huawei Local Security Checks	high
146709	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2021-1320)	Nessus	Huawei Local Security Checks	high
146680	EulerOS 2.0 SP2 : compat-libtiff3 (EulerOS-SA-2021-1285)	Nessus	Huawei Local Security Checks	high
146160	EulerOS 2.0 SP5 : compat-libtiff3 (EulerOS-SA-2021-1184)	Nessus	Huawei Local Security Checks	high
146131	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2021-1207)	Nessus	Huawei Local Security Checks	high
145166	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2021-1089)	Nessus	Huawei Local Security Checks	high
145116	EulerOS 2.0 SP3 : compat-libtiff3 (EulerOS-SA-2021-1062)	Nessus	Huawei Local Security Checks	high
109674	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:1179-1)	Nessus	SuSE Local Security Checks	critical
108513	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3602-1)	Nessus	Ubuntu Local Security Checks	high
106414	Debian DSA-4100-1 : tiff - security update	Nessus	Debian Local Security Checks	high
103094	Debian DLA-1094-1 : tiff3 security update	Nessus	Debian Local Security Checks	high
103093	Debian DLA-1093-1 : tiff security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-11335

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high