Debian update for tiff

1) Memory corruption

EUVDB-ID: #VU11499

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9935

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the t2p_write_pdf function in tools/tiff2pdf.c due to heap-based buffer overflow. A remote attacker can submit a specially crafted TIFF document, trigger out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU12657

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-11335

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in the ZIPDecode function in tif_zip.c in tools/tiff2pdf.c due to heap-based buffer overflow. A remote attacker can trick the victim into opening a specially crafted PlanarConfig=Contig image, trigger a more than one hundred bytes out-of-bounds write and cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Uncontrolled memory allocation

EUVDB-ID: #VU11495

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12944

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the TIFFReadDirEntryArray function in tif_read.c due to mishandling memory allocation for short files. A remote attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Assertion failure

EUVDB-ID: #VU13514

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-13726

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to a reachable assertion abort in the function TIFFWriteDirectorySec(), related to tif_dirwrite.c and a SubIFD tag when processing malicious input. A remote attacker can send specially crafted input, trigger assertion failure and cause the service to crash.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU9820

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18013

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference error in tif_print.c within TIFFPrintDirectory() function. A remote attacker can trigger a NULL pointer dereference error and crash the affected application.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Reachable Assertion

EUVDB-ID: #VU15682

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-13727

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A specially crafted input will lead to a remote denial of service attack.

Mitigation

Update the affected package to version: 4.0.3-12.3+deb8u5, 4.0.8-2+deb9u2.

Vulnerable software versions

tiff (Debian package): 4.0.8-1 - 4.0.8-2+deb9u1

External links

http://www.debian.org/security/2018/dsa-4100

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.