http://bugzilla.maptools.org/show_bug.cgi?id=2772

https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef

[debian-lts-announce] 20180531 [SECURITY] [DLA 1391-1] tiff security update

[debian-lts-announce] 20180702 [SECURITY] [DLA 1411-1] tiff security update

USN-3602-1

USN-3606-1

DSA-4349

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - A NULL Pointer Dereference occurs in the function     TIFFPrintDirectory in tif_print.c in LibTIFF 4.0.9 when     using the tiffinfo tool to print crafted TIFF     information, a different vulnerability than     CVE-2017-18013. (This affects an earlier part of the     TIFFPrintDirectory function that was not addressed by     the CVE-2017-18013 patch.)(CVE-2018-7456)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libtiff package has been released.

Added fix for **CVE-2018-5784**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.

An update of {'openjdk8', 'httpd', 'librelp', 'zsh', 'libvirt', 'libtiff'} packages of Photon OS has been released.

Several issues were discovered in TIFF, the Tag Image File Format library, that allowed remote attackers to cause a denial of service or other unspecified impact via a crafted image file.

CVE-2017-11613: DoS vulnerability A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the
_TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer.

CVE-2018-10963: DoS vulnerability The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.

CVE-2018-5784: DoS vulnerability In LibTIFF, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c.
Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

CVE-2018-7456: NULL pointer Dereference A NULL pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)

CVE-2018-8905: Heap-based buffer overflow In LibTIFF, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

For Debian 8 'Jessie', these problems have been fixed in version 4.0.3-12.3+deb8u6.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service :

CVE-2017-11613

Ddenial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack and can either make the system hand or trigger the OOM killer.

CVE-2018-5784

There is an uncontrolled resource consumption in TIFFSetDirectory function of src/libtiff/tif_dir.c, which can cause denial of service through a crafted tif file.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u21.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

  - CVE-2017-9935: There was a heap-based buffer overflow in     the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution (bsc#1046077)

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2018-5784: There is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a crafted     tif file. This occurs because the declared number of     directory entries is not validated against the actual     number of directory entries (bsc#1081690)

This update was imported from the SUSE:SLE-12:Update update project.

This update for tiff fixes the following issues :

  - CVE-2017-9935: There was a heap-based buffer overflow in     the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution (bsc#1046077)

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2018-5784: There is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a crafted     tif file. This occurs because the declared number of     directory entries is not validated against the actual     number of directory entries (bsc#1081690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151389	EulerOS Virtualization 3.0.2.2 : libtiff (EulerOS-SA-2021-2145)	Nessus	Huawei Local Security Checks	high
142585	EulerOS Virtualization 3.0.6.6 : libtiff (EulerOS-SA-2020-2448)	Nessus	Huawei Local Security Checks	high
142358	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2020-2361)	Nessus	Huawei Local Security Checks	high
140912	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2020-2145)	Nessus	Huawei Local Security Checks	high
140333	EulerOS Virtualization for ARM 64 3.0.2.0 : libtiff (EulerOS-SA-2020-1963)	Nessus	Huawei Local Security Checks	high
140145	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2020-1924)	Nessus	Huawei Local Security Checks	high
121936	Photon OS 2.0: Libtiff PHSA-2018-2.0-0039	Nessus	PhotonOS Local Security Checks	critical
120550	Fedora 28 : libtiff (2018-7a0f7f5768)	Nessus	Fedora Local Security Checks	medium
119314	Debian DSA-4349-1 : tiff - security update	Nessus	Debian Local Security Checks	high
111298	Photon OS 2.0 : openjdk8 / httpd / librelp / zsh / libvirt (PhotonOS-PHSA-2018-2.0-0039) (deprecated)	Nessus	PhotonOS Local Security Checks	critical
110840	Debian DLA-1411-1 : tiff security update	Nessus	Debian Local Security Checks	high
110313	Debian DLA-1391-1 : tiff security update	Nessus	Debian Local Security Checks	medium
109716	openSUSE Security Update : tiff (openSUSE-2018-443)	Nessus	SuSE Local Security Checks	high
109675	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:1180-1)	Nessus	SuSE Local Security Checks	high
108702	Fedora 27 : libtiff (2018-e6a51e99a4)	Nessus	Fedora Local Security Checks	medium
108657	Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : LibTIFF vulnerabilities (USN-3606-1)	Nessus	Ubuntu Local Security Checks	critical
108513	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3602-1)	Nessus	Ubuntu Local Security Checks	high

CVE-2018-5784

medium

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Tenable Plugins

high

high

high

high

high

high

critical

medium

high

critical

high

medium

high

high

medium

critical

high