SUSE SLES12 Security Update : tiff (SUSE-SU-2022:0496-1)

high Nessus Plugin ID 158189

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0496-1 advisory.

- tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file. (CVE-2017-17095)

- tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a Negative-size-param condition. (CVE-2019-17546)

- Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage() function in the component tiffcrop. (CVE-2020-19131)

- A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service. (CVE-2020-35521)

- In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. (CVE-2020-35522)

- An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

- A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

- LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtiff-devel, libtiff5, libtiff5-32bit and / or tiff packages.

See Also

https://bugzilla.suse.com/1071031

https://bugzilla.suse.com/1154365

https://bugzilla.suse.com/1182808

https://bugzilla.suse.com/1182809

https://bugzilla.suse.com/1182811

https://bugzilla.suse.com/1182812

https://bugzilla.suse.com/1190312

https://bugzilla.suse.com/1194539

http://www.nessus.org/u?845053af

https://www.suse.com/security/cve/CVE-2017-17095

https://www.suse.com/security/cve/CVE-2019-17546

https://www.suse.com/security/cve/CVE-2020-19131

https://www.suse.com/security/cve/CVE-2020-35521

https://www.suse.com/security/cve/CVE-2020-35522

https://www.suse.com/security/cve/CVE-2020-35523

https://www.suse.com/security/cve/CVE-2020-35524

https://www.suse.com/security/cve/CVE-2022-22844

Plugin Details

Severity: High

ID: 158189

File Name: suse_SU-2022-0496-1.nasl

Version: 1.4

Type: local

Agent: unix

Published: 2/19/2022

Updated: 5/6/2022

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: E:POC/RL:OF/RC:C

CVSS Score Source: CVE-2020-35524

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: E:P/RL:O/RC:C

CVSS Score Source: CVE-2019-17546

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libtiff-devel, p-cpe:/a:novell:suse_linux:libtiff5, p-cpe:/a:novell:suse_linux:libtiff5-32bit, p-cpe:/a:novell:suse_linux:tiff, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/18/2022

Vulnerability Publication Date: 12/2/2017

Reference Information

CVE: CVE-2017-17095, CVE-2019-17546, CVE-2020-19131, CVE-2020-35521, CVE-2020-35522, CVE-2020-35523, CVE-2020-35524, CVE-2022-22844

SuSE: SUSE-SU-2022:0496-1