This update for tiff fixes the following issues :

  - CVE-2016-3622: Specially crafted TIFF images could     trigger a crash in tiff2rgba (bsc#974449)

  - Various out-of-bound write vulnerabilities with     unspecified impact (MSVR 35093, MSVR 35094, MSVR 35095,     MSVR 35096, MSVR 35097, MSVR 35098)

  - CVE-2016-5314: Specially crafted TIFF images could     trigger a crash that could result in DoS (bsc#984831)

  - CVE-2016-5316: Specially crafted TIFF images could     trigger a crash in the rgb2ycbcr tool, leading to Doa     (bsc#984837)

  - CVE-2016-5317: Specially crafted TIFF images could     trigger a crash through an out of bound write     (bsc#984842)

  - CVE-2016-5320: Specially crafted TIFF images could     trigger a crash or potentially allow remote code     execution when using the rgb2ycbcr command (bsc#984808)

  - CVE-2016-5875: Specially crafted TIFF images could     trigger could allow arbitrary code execution     (bsc#987351)

  - CVE-2016-3623: Specially crafted TIFF images could     trigger a crash in rgb2ycbcr (bsc#974618)

  - CVE-2016-3945: Specially crafted TIFF images could     trigger a crash or allow for arbitrary command execution     via tiff2rgba (bsc#974614)

  - CVE-2016-3990: Specially crafted TIFF images could     trigger a crash or allow for arbitrary command execution     (bsc#975069)

  - CVE-2016-3186: Specially crafted TIFF imaged could     trigger a crash in the gif2tiff command via a buffer     overflow (bsc#973340)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Version 3.9.6-11+deb7u1 and 3.9.6-11+deb7u2 introduced changes that resulted in libtiff writing out invalid tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image.

For Debian 7 'Wheezy', these problems have been fixed in version 3.9.6-11+deb7u3.

We recommend that you upgrade your tiff3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

  - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783:
    Out-of-bounds writes for invalid images (bsc#964225)

  - CVE-2016-3186: Buffer overflow in gif2tiff (bnc#973340).

  - CVE-2016-5875: heap-based buffer overflow when using the     PixarLog compressionformat (bsc#987351)

  - CVE-2016-5316: Out-of-bounds read in PixarLogCleanup()     function in tif_pixarlog.c (bsc#984837)

  - CVE-2016-5314: Out-of-bounds write in PixarLogDecode()     function (bsc#984831)

  - CVE-2016-5317: Out-of-bounds write in PixarLogDecode()     function in libtiff.so (bsc#984842)

  - CVE-2016-5320: Out-of-bounds write in PixarLogDecode()     function in tif_pixarlog.c (bsc#984808) 

This update was imported from the SUSE:SLE-12:Update update project.

CVE-2016-5314

Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.

Note : This was previously referenced as CVE-2016-5320. All CVE users should reference CVE-2016-5314 instead of CVE-2016-5320.

CVE-2015-8784 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif.

Impact

An attacker can use specially crafted TIFF files to execute arbitrary code with the limited privileges of the image optimization process.

ID	Name	Product	Family	Published	Updated	Severity
94067	SUSE SLES11 Security Update : tiff (SUSE-SU-2016:2527-1)	Nessus	SuSE Local Security Checks	10/14/2016	1/21/2026	high
93322	Debian DLA-610-2 : tiff3 regression update	Nessus	Debian Local Security Checks	9/6/2016	1/27/2026	critical
93585	openSUSE Security Update : tiff (openSUSE-2016-1089)	Nessus	SuSE Local Security Checks	9/19/2016	1/23/2026	high
94648	F5 Networks BIG-IP : LibTIFF vulnerabilities (K89096577)	Nessus	F5 Networks Local Security Checks	11/9/2016	1/19/2026	high

Detections

Analytics

Plugins Search

high

critical

high

high