http://bugzilla.maptools.org/show_bug.cgi?id=2658

DSA-3844

97510

GLSA-201709-27

USN-3602-1

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff to version 4.0.8 fixes a several bugs and security issues :

These security issues were fixed :

  - CVE-2017-7595: The JPEGSetupEncode function allowed     remote attackers to cause a denial of service     (divide-by-zero error and application crash) via a     crafted image (bsc#1033127).

  - CVE-2016-10371: The TIFFWriteDirectoryTagCheckedRational     function allowed remote attackers to cause a denial of     service (assertion failure and application exit) via a     crafted TIFF file (bsc#1038438).

  - CVE-2017-7598: Error in tif_dirread.c allowed remote     attackers to cause a denial of service (divide-by-zero     error and application crash) via a crafted image     (bsc#1033118).

  - CVE-2017-7596: Undefined behavior because of floats     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033126).

  - CVE-2017-7597: Undefined behavior because of floats     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033120).

  - CVE-2017-7599: Undefined behavior because of shorts     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033113).

  - CVE-2017-7600: Undefined behavior because of chars     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033112).

  - CVE-2017-7601: Because of a shift exponent too large for     64-bit type long undefined behavior was caused, which     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033111).

  - CVE-2017-7602: Prevent signed integer overflow, which     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033109).

  - CVE-2017-7592: The putagreytile function had a     left-shift undefined behavior issue, which might allowed     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033131).

  - CVE-2017-7593: Ensure that tif_rawdata is properly     initialized, to prevent remote attackers to obtain     sensitive information from process memory via a crafted     image (bsc#1033129).

  - CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable     function allowed remote attackers to cause a denial of     service (memory leak) via a crafted image (bsc#1033128).

  - CVE-2017-9403: Prevent memory leak in function     TIFFReadDirEntryLong8Array, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1042805).

  - CVE-2017-9404: Fixed memory leak vulnerability in     function OJPEGReadHeaderInfoSecTablesQTable, which     allowed attackers to cause a denial of service via a     crafted file (bsc#1042804).

These various other issues were fixed :

  - Fix uint32 overflow in TIFFReadEncodedStrip() that     caused an integer division by zero. Reported by Agostino     Sarubbo.

  - fix heap-based buffer overflow on generation of PixarLog     / LUV compressed files, with ColorMap, TransferFunction     attached and nasty plays with bitspersample. The fix for     LUV has not been tested, but suffers from the same kind     of issue of PixarLog.

  - modify ChopUpSingleUncompressedStrip() to instanciate     compute ntrips as TIFFhowmany_32(td->td_imagelength,     rowsperstrip), instead of a logic based on the total     size of data. Which is faulty is the total size of data     is not sufficient to fill the whole image, and thus     results in reading outside of the     StripByCounts/StripOffsets arrays when using     TIFFReadScanline()

  - make OJPEGDecode() early exit in case of failure in     OJPEGPreDecode(). This will avoid a divide by zero, and     potential other issues.

  - fix misleading indentation as warned by GCC.

  - revert change done on 2016-01-09 that made Param member     of TIFFFaxTabEnt structure a uint16 to reduce size of     the binary. It happens that the Hylafax software uses     the tables that follow this typedef (TIFFFaxMainTable,     TIFFFaxWhiteTable, TIFFFaxBlackTable), although they are     not in a public libtiff header.

  - add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt()     variants of the functions without ext, with an extra     argument to control the stop_on_error behaviour.

  - fix potential memory leaks in error code path of     TIFFRGBAImageBegin().

  - increase libjpeg max memory usable to 10 MB instead of     libjpeg 1MB default. This helps when creating files with     'big' tile, without using libjpeg temporary files.

  - add _TIFFcalloc()

  - return 0 in Encode functions instead of -1 when     TIFFFlushData1() fails.

  - only run JPEGFixupTagsSubsampling() if the     YCbCrSubsampling tag is not explicitly present. This     helps a bit to reduce the I/O amount when the tag is     present (especially on cloud hosted files).

  - in LZWPostEncode(), increase, if necessary, the code     bit-width after flushing the remaining code and before     emitting the EOI code.

  - fix memory leak in error code path of     PixarLogSetupDecode().

  - fix potential memory leak in     OJPEGReadHeaderInfoSecTablesQTable,     OJPEGReadHeaderInfoSecTablesDcTable and     OJPEGReadHeaderInfoSecTablesAcTable

  - avoid crash in Fax3Close() on empty file.

  - TIFFFillStrip(): add limitation to the number of bytes     read in case td_stripbytecount[strip] is bigger than     reasonable, so as to avoid excessive memory allocation.

  - fix memory leak when the underlying codec (ZIP,     PixarLog) succeeds its setupdecode() method, but     PredictorSetup fails.

  - TIFFFillStrip() and TIFFFillTile(): avoid excessive     memory allocation in case of shorten files. Only     effective on 64 bit builds and non-mapped cases.

  - TIFFFillStripPartial() / TIFFSeek(), avoid potential     integer overflows with read_ahead in     CHUNKY_STRIP_READ_SUPPORT mode.

  - avoid excessive memory allocation in case of shorten     files. Only effective on 64 bit builds.

  - update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with     tif_rawdataloaded when calling TIFFStartStrip() or     TIFFFillStripPartial(). 

  - avoid potential int32 overflow in TIFFYCbCrToRGBInit()     Fixes

  - avoid potential int32 overflows in multiply_ms() and     add_ms().

  - fix out-of-buffer read in PackBitsDecode() Fixes

  - LogL16InitState(): avoid excessive memory allocation     when RowsPerStrip tag is missing.

  - update dec_bitsleft at beginning of LZWDecode(), and     update tif_rawcc at end of LZWDecode(). This is needed     to properly work with the latest chnges in tif_read.c in     CHUNKY_STRIP_READ_SUPPORT mode.

  - PixarLogDecode(): resync tif_rawcp with next_in and     tif_rawcc with avail_in at beginning and end of     function, similarly to what is done in LZWDecode().
    Likely needed so that it works properly with latest     chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.

  - initYCbCrConversion(): add basic validation of luma and     refBlackWhite coefficients (just check they are not NaN     for now), to avoid potential float to int overflows.

  - _TIFFVSetField(): fix outside range cast of double to     float.

  - initYCbCrConversion(): check luma[1] is not zero to     avoid division by zero

  - _TIFFVSetField(): fix outside range cast of double to     float.

  - initYCbCrConversion(): check luma[1] is not zero to     avoid division by zero.

  - initYCbCrConversion(): stricter validation for     refBlackWhite coefficients values.

  - avoid uint32 underflow in cpDecodedStrips that can cause     various issues, such as buffer overflows in the library.

  - fix readContigStripsIntoBuffer() in -i (ignore) mode so     that the output buffer is correctly incremented to avoid     write outside bounds.

  - add 3 extra bytes at end of strip buffer in     readSeparateStripsIntoBuffer() to avoid read outside of     heap allocated buffer.

  - fix integer division by zero when BitsPerSample is     missing.

  - fix NULL pointer dereference in -r mode when the image     has no StripByteCount tag.

  - avoid potential division by zero is BitsPerSamples tag     is missing.

  - when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called,     limit the return number of inks to SamplesPerPixel, so     that code that parses ink names doesn't go past the end     of the buffer.

  - avoid potential division by zero is BitsPerSamples tag     is missing.

  - fix uint32 underflow/overflow that can cause heap-based     buffer overflow.

  - replace assert( (bps % 8) == 0 ) by a non assert check.

  - fix 2 heap-based buffer overflows (in PSDataBW and     PSDataColorContig).

  - prevent heap-based buffer overflow in -j mode on a     paletted image.

  - fix wrong usage of memcpy() that can trigger unspecified     behaviour.

  - avoid potential invalid memory read in t2p_writeproc.

  - avoid potential heap-based overflow in     t2p_readwrite_pdf_image_tile().

  - remove extraneous TIFFClose() in error code path, that     caused double free.

  - error out cleanly in cpContig2SeparateByRow and     cpSeparate2ContigByRow if BitsPerSample != 8 to avoid     heap based overflow.

  - avoid integer division by zero.

  - call TIFFClose() in error code paths.

  - emit appropriate message if the input file is empty.

  - close TIFF handle in error code path.

This update was imported from the SUSE:SLE-12:Update update project.

This update for tiff to version 4.0.8 fixes a several bugs and security issues: These security issues were fixed :

  - CVE-2017-7595: The JPEGSetupEncode function allowed     remote attackers to cause a denial of service     (divide-by-zero error and application crash) via a     crafted image (bsc#1033127).

  - CVE-2016-10371: The TIFFWriteDirectoryTagCheckedRational     function allowed remote attackers to cause a denial of     service (assertion failure and application exit) via a     crafted TIFF file (bsc#1038438).

  - CVE-2017-7598: Error in tif_dirread.c allowed remote     attackers to cause a denial of service (divide-by-zero     error and application crash) via a crafted image     (bsc#1033118).

  - CVE-2017-7596: Undefined behavior because of floats     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033126).

  - CVE-2017-7597: Undefined behavior because of floats     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033120).

  - CVE-2017-7599: Undefined behavior because of shorts     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033113).

  - CVE-2017-7600: Undefined behavior because of chars     outside their expected value range, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image (bsc#1033112).

  - CVE-2017-7601: Because of a shift exponent too large for     64-bit type long undefined behavior was caused, which     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033111).

  - CVE-2017-7602: Prevent signed integer overflow, which     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033109).

  - CVE-2017-7592: The putagreytile function had a     left-shift undefined behavior issue, which might allowed     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image (bsc#1033131).

  - CVE-2017-7593: Ensure that tif_rawdata is properly     initialized, to prevent remote attackers to obtain     sensitive information from process memory via a crafted     image (bsc#1033129).

  - CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable     function allowed remote attackers to cause a denial of     service (memory leak) via a crafted image (bsc#1033128).

  - CVE-2017-9403: Prevent memory leak in function     TIFFReadDirEntryLong8Array, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1042805).

  - CVE-2017-9404: Fixed memory leak vulnerability in     function OJPEGReadHeaderInfoSecTablesQTable, which     allowed attackers to cause a denial of service via a     crafted file (bsc#1042804). These various other issues     were fixed :

  - Fix uint32 overflow in TIFFReadEncodedStrip() that     caused an integer division by zero. Reported by Agostino     Sarubbo.

  - fix heap-based buffer overflow on generation of PixarLog     / LUV compressed files, with ColorMap, TransferFunction     attached and nasty plays with bitspersample. The fix for     LUV has not been tested, but suffers from the same kind     of issue of PixarLog.

  - modify ChopUpSingleUncompressedStrip() to instanciate     compute ntrips as TIFFhowmany_32(td->td_imagelength,     rowsperstrip), instead of a logic based on the total     size of data. Which is faulty is the total size of data     is not sufficient to fill the whole image, and thus     results in reading outside of the     StripByCounts/StripOffsets arrays when using     TIFFReadScanline()

  - make OJPEGDecode() early exit in case of failure in     OJPEGPreDecode(). This will avoid a divide by zero, and     potential other issues.

  - fix misleading indentation as warned by GCC.

  - revert change done on 2016-01-09 that made Param member     of TIFFFaxTabEnt structure a uint16 to reduce size of     the binary. It happens that the Hylafax software uses     the tables that follow this typedef (TIFFFaxMainTable,     TIFFFaxWhiteTable, TIFFFaxBlackTable), although they are     not in a public libtiff header.

  - add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt()     variants of the functions without ext, with an extra     argument to control the stop_on_error behaviour.

  - fix potential memory leaks in error code path of     TIFFRGBAImageBegin().

  - increase libjpeg max memory usable to 10 MB instead of     libjpeg 1MB default. This helps when creating files with     'big' tile, without using libjpeg temporary files.

  - add _TIFFcalloc()

  - return 0 in Encode functions instead of -1 when     TIFFFlushData1() fails.

  - only run JPEGFixupTagsSubsampling() if the     YCbCrSubsampling tag is not explicitly present. This     helps a bit to reduce the I/O amount when the tag is     present (especially on cloud hosted files).

  - in LZWPostEncode(), increase, if necessary, the code     bit-width after flushing the remaining code and before     emitting the EOI code.

  - fix memory leak in error code path of     PixarLogSetupDecode().

  - fix potential memory leak in     OJPEGReadHeaderInfoSecTablesQTable,     OJPEGReadHeaderInfoSecTablesDcTable and     OJPEGReadHeaderInfoSecTablesAcTable

  - avoid crash in Fax3Close() on empty file.

  - TIFFFillStrip(): add limitation to the number of bytes     read in case td_stripbytecount[strip] is bigger than     reasonable, so as to avoid excessive memory allocation.

  - fix memory leak when the underlying codec (ZIP,     PixarLog) succeeds its setupdecode() method, but     PredictorSetup fails.

  - TIFFFillStrip() and TIFFFillTile(): avoid excessive     memory allocation in case of shorten files. Only     effective on 64 bit builds and non-mapped cases.

  - TIFFFillStripPartial() / TIFFSeek(), avoid potential     integer overflows with read_ahead in     CHUNKY_STRIP_READ_SUPPORT mode.

  - avoid excessive memory allocation in case of shorten     files. Only effective on 64 bit builds.

  - update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with     tif_rawdataloaded when calling TIFFStartStrip() or     TIFFFillStripPartial().

  - avoid potential int32 overflow in TIFFYCbCrToRGBInit()     Fixes

  - avoid potential int32 overflows in multiply_ms() and     add_ms().

  - fix out-of-buffer read in PackBitsDecode() Fixes

  - LogL16InitState(): avoid excessive memory allocation     when RowsPerStrip tag is missing.

  - update dec_bitsleft at beginning of LZWDecode(), and     update tif_rawcc at end of LZWDecode(). This is needed     to properly work with the latest chnges in tif_read.c in     CHUNKY_STRIP_READ_SUPPORT mode.

  - PixarLogDecode(): resync tif_rawcp with next_in and     tif_rawcc with avail_in at beginning and end of     function, similarly to what is done in LZWDecode().
    Likely needed so that it works properly with latest     chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.

  - initYCbCrConversion(): add basic validation of luma and     refBlackWhite coefficients (just check they are not NaN     for now), to avoid potential float to int overflows.

  - _TIFFVSetField(): fix outside range cast of double to     float.

  - initYCbCrConversion(): check luma[1] is not zero to     avoid division by zero

  - _TIFFVSetField(): fix outside range cast of double to     float.

  - initYCbCrConversion(): check luma[1] is not zero to     avoid division by zero.

  - initYCbCrConversion(): stricter validation for     refBlackWhite coefficients values.

  - avoid uint32 underflow in cpDecodedStrips that can cause     various issues, such as buffer overflows in the library.

  - fix readContigStripsIntoBuffer() in -i (ignore) mode so     that the output buffer is correctly incremented to avoid     write outside bounds.

  - add 3 extra bytes at end of strip buffer in     readSeparateStripsIntoBuffer() to avoid read outside of     heap allocated buffer.

  - fix integer division by zero when BitsPerSample is     missing.

  - fix NULL pointer dereference in -r mode when the image     has no StripByteCount tag.

  - avoid potential division by zero is BitsPerSamples tag     is missing.

  - when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called,     limit the return number of inks to SamplesPerPixel, so     that code that parses ink names doesn't go past the end     of the buffer.

  - avoid potential division by zero is BitsPerSamples tag     is missing.

  - fix uint32 underflow/overflow that can cause heap-based     buffer overflow.

  - replace assert( (bps % 8) == 0 ) by a non assert check.

  - fix 2 heap-based buffer overflows (in PSDataBW and     PSDataColorContig).

  - prevent heap-based buffer overflow in -j mode on a     paletted image.

  - fix wrong usage of memcpy() that can trigger unspecified     behaviour.

  - avoid potential invalid memory read in t2p_writeproc.

  - avoid potential heap-based overflow in     t2p_readwrite_pdf_image_tile().

  - remove extraneous TIFFClose() in error code path, that     caused double free.

  - error out cleanly in cpContig2SeparateByRow and     cpSeparate2ContigByRow if BitsPerSample != 8 to avoid     heap based overflow.

  - avoid integer division by zero.

  - call TIFFClose() in error code paths.

  - emit appropriate message if the input file is empty.

  - close TIFF handle in error code path.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-27 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in LibTIFF. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing the user to process a specially crafted       TIFF file, could possibly execute arbitrary code with the privileges of       the process, cause a Denial of Service condition, obtain sensitive       information, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

Security fix for :

  - **CVE-2017-7592**

  - **CVE-2017-7593**

  - **CVE-2017-7594**

  - **CVE-2017-7595**

  - **CVE-2017-7596**

  - **CVE-2017-7597**

  - **CVE-2017-7598**

  - **CVE-2017-7599**

  - **CVE-2017-7600**

  - **CVE-2017-7601**

  - **CVE-2017-7602**

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service, memory disclosure or the execution of arbitrary code.

Multiple security issues have been found in the tiff image library that may allow remote attackers to cause a denial of service (application crash), to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted image

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u12.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
108513	Ubuntu 14.04 LTS / 16.04 LTS : tiff vulnerabilities (USN-3602-1)	Nessus	Ubuntu Local Security Checks	medium
103658	openSUSE Security Update : tiff (openSUSE-2017-1118)	Nessus	SuSE Local Security Checks	medium
103503	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2017:2569-1)	Nessus	SuSE Local Security Checks	medium
103486	GLSA-201709-27 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
101733	Fedora 26 : libtiff (2017-d95dacdfbf)	Nessus	Fedora Local Security Checks	medium
99973	Debian DSA-3844-1 : tiff - security update	Nessus	Debian Local Security Checks	high
99636	Debian DLA-911-1 : tiff security update	Nessus	Debian Local Security Checks	medium
99551	FreeBSD : tiff -- multiple vulnerabilities (2a96e498-3234-4950-a9ad-419bc84a839d)	Nessus	FreeBSD Local Security Checks	high
99404	Fedora 25 : libtiff (2017-021bebae25)	Nessus	Fedora Local Security Checks	medium

CVE-2017-7592

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins