SB2018120802 - OpenSUSE Linux update for tiff

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2016-10092)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c when processing malicious input. A remote attacker can send a specially crafted image, trigger memory corruption and cause the service to crash.

2) Memory corruption (CVE-ID: CVE-2016-10093)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in tools/tiffcp.c when processing malicious input. A remote attacker can send a specially crafted image, trigger heap-based buffer overflow and cause the service to crash.

3) Off-by-one error (CVE-ID: CVE-2016-10094)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c when processing malicious input. A remote attacker can send a specially crafted image and cause the service to crash.

4) Out-of-bounds read (CVE-ID: CVE-2016-6223)

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition.

The vulnerability exists due to out-of-bounds read condition by the TIFFReadRawStrip1 and TIFFReadRawTile1 functions, as defined in the tif_read.c source code file. A remote attacker can trick the victim into opening or executing a file that submits malicious input and cause a DoS condition or possibly access sensitive information.

5) Uncontrolled memory allocation (CVE-ID: CVE-2017-12944)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the TIFFReadDirEntryArray function in tif_read.c due to mishandling memory allocation for short files. A remote attacker can trigger memory corruption and cause the service to crash.

6) NULL pointer dereference (CVE-ID: CVE-2018-19210)

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to insufficient validation of user-supplied input processed by the TIFFWriteDirectorySec function, as defined in the tif_dirwrite.c source code file. A remote attacker can trick the victim into opening or executing a file that submits malicious input, trigger a NULL pointer dereference and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00020.html