SUSE SLES11 Security Update : tiff (SUSE-SU-2018:3879-1)

critical Nessus Plugin ID 119143



The remote SUSE host is missing one or more security updates.


This update for tiff fixes the following issues :

Security issues fixed :

CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672).

CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257).

CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322).

CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080).

CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186).

CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163).

CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440).

CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448).

CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447)

CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446)

CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461).

Non-security issues fixed: asan_build: build ASAN included

debug_build: build more suitable for debugging

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t patch sdksp4-tiff-13878=1

SUSE Linux Enterprise Server 11-SP4:zypper in -t patch slessp4-tiff-13878=1

SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch dbgsp4-tiff-13878=1

See Also

Plugin Details

Severity: Critical

ID: 119143

File Name: suse_SU-2018-3879-1.nasl

Version: 1.5

Type: local

Agent: unix

Published: 11/26/2018

Updated: 1/19/2021

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: Medium

Score: 6.7


Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:POC/RL:OF/RC:C


Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libtiff3, p-cpe:/a:novell:suse_linux:tiff, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/23/2018

Vulnerability Publication Date: 10/3/2016

Reference Information

CVE: CVE-2015-8870, CVE-2016-3619, CVE-2016-3620, CVE-2016-3621, CVE-2016-5319, CVE-2016-9273, CVE-2017-17942, CVE-2017-9117, CVE-2017-9147, CVE-2018-12900, CVE-2018-18661