SB2018061164 - Fedora 28 update for mingw-libtiff

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2016-10092)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c when processing malicious input. A remote attacker can send a specially crafted image, trigger memory corruption and cause the service to crash.

2) Memory corruption (CVE-ID: CVE-2016-10093)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in tools/tiffcp.c when processing malicious input. A remote attacker can send a specially crafted image, trigger heap-based buffer overflow and cause the service to crash.

3) Off-by-one error (CVE-ID: CVE-2016-10094)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c when processing malicious input. A remote attacker can send a specially crafted image and cause the service to crash.

4) Stack-based buffer overflow (CVE-ID: CVE-2016-10095)

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exits due to stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

5) Heap-based buffer overflow (CVE-ID: CVE-2017-5225)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in "tools/tiffcp.cwhen" processing images. A remote attacker can create an image with specially crafted BitsPerSample value, trigger heap-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Heap-based buffer over-read (CVE-ID: CVE-2017-5563)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in tif_lzw.c due to heap-based buffer over-read. A remote attacker can trigger memory corruption and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2018-cc86e5bc77