SB2018112002 - Arch Linux update for libtiff
Published: November 20, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Memory corruption (CVE-ID: CVE-2017-9935)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists in the t2p_write_pdf function in tools/tiff2pdf.c due to heap-based buffer overflow. A remote attacker can submit a specially crafted TIFF document, trigger out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may result in system compromise.
2) Improper input validation (CVE-ID: CVE-2017-11613)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the TIFFOpen function due to improper checking of td_imagelength during the TIFFOpen process. A remote attacker can cause the service to crash.
3) Out-of-bounds write (CVE-ID: CVE-2018-18557)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to decoding of arbitrarily-sized JBIG into a buffer, ignoring the buffer size. A remote unauthenticated attacker can supply specially crafted input, trigger a tif_jbig.c JBIGDecode out-of-bounds write and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Null pointer dereference (CVE-ID: CVE-2018-18661)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. A remote attacker can trick the victim into opening a specially crafted input, trigger NULL pointer dereference and cause the service to crash.
Remediation
Install update from vendor's website.