Alpine: tiff: security update to 4.0.7-r0

high Tenable Cloud Security Plugin ID 407363

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service
(out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a
TIFFTAG_JPEGTABLES of length one. (CVE-2016-9453)

- LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a
crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2)
compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in
tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5)
tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7)
TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. (CVE-2014-8127)

- Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to
cause a denial of service (application crash) via a crafted GIF file. (CVE-2016-3186)

- The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw"
option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP
image. (CVE-2016-3621)

- The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote
attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. (CVE-2016-3622)

Plugin Details

Severity: High

ID: 407363

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 11/11/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-9453

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2016-5314

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/24/2015

Reference Information

CVE: CVE-2014-8127, CVE-2016-3186, CVE-2016-3621, CVE-2016-3622, CVE-2016-3623, CVE-2016-3624, CVE-2016-3625, CVE-2016-3658, CVE-2016-5314, CVE-2016-5315, CVE-2016-5316, CVE-2016-5317, CVE-2016-5321, CVE-2016-5323, CVE-2016-5652, CVE-2016-9273, CVE-2016-9297, CVE-2016-9448, CVE-2016-9453

BID: 72323, 85744, 85917, 85918, 85952, 85956, 85957, 91196, 91203, 91204, 91208, 91209, 91245, 93331, 93902, 94271, 94406, 94419, 94420

Detections

Analytics