Slackware Linux update for libtiff

1) NULL pointer dereference

EUVDB-ID: #VU10792

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7456

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The vulnerability exists in the TIFFPrintDirectory function that is defined in the tif_print.c source code file due to NULL pointer dereference. A remote attacker can create a specially crafted TIFF file, trick the victim into opening it and cause the service to crash.

Mitigation

Update the affected package libtiff.

Vulnerable software versions

Slackware Linux: 14.2

External links

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.360306

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Heap-based buffer overflow

EUVDB-ID: #VU11263

Risk: High

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:U]

CVE-ID: CVE-2018-8905

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in the LZWDecodeCompat function due to insufficient validation of user-supplied input. A remote attacker can submit a specially crafted TIFF file, cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package libtiff.

Vulnerable software versions

Slackware Linux: 14.2

External links

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.360306

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Heap-based buffer over-read

EUVDB-ID: #VU12422

Risk: Low

CVSSv3.1: 2.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:U]

CVE-ID: CVE-2018-10779

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the TIFFWriteScanline function in the tif_write.csource code file due to insufficient validation of user-supplied input. A local attacker can use the .bmp2tiff command to execute a specially crafted file, trigger heap-based buffer over-read and cause the service to crash.

Mitigation

Update the affected package libtiff.

Vulnerable software versions

Slackware Linux: 14.2

External links

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.360306

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Input validation error

EUVDB-ID: #VU13373

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-10963

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause denial of service conditions.

The vulnerability exists due to insufficient validation of user-supplied input processed by the TIFFWriteDirectorySec() function, as defined in the tif_dirwrite.c source code file. A remote attacker can trick the victim into opening a specially crafted file, trigger assertion failure and cause the application to crash.

Mitigation

Update the affected package libtiff.

Vulnerable software versions

Slackware Linux: 14.2

External links

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.360306

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Null pointer dereference

EUVDB-ID: #VU15901

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-18661

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. A remote attacker can trick the victim into opening a specially crafted input, trigger NULL pointer dereference and cause the service to crash.

Mitigation

Update the affected package libtiff.

Vulnerable software versions

Slackware Linux: 14.2

External links

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.360306

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.