Security update for tiff SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0353-1 Final 1 1 2016-02-05T16:42:21Z current 2016-02-05T16:42:21Z 2016-02-05T16:42:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783: Out-of-bounds writes for invalid images (bsc#964225) - CVE-2015-7554: Out-of-bounds Write in the thumbnail and tiffcmp tools (bsc#960341) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-tiff-12389,sledsp4-tiff-12389,slessp4-tiff-12389 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160353-1/ Link for SUSE-SU-2016:0353-1 https://lists.suse.com/pipermail/sle-security-updates/2016-February/001854.html E-Mail link for SUSE-SU-2016:0353-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/960341 SUSE Bug 960341 https://bugzilla.suse.com/964225 SUSE Bug 964225 https://www.suse.com/security/cve/CVE-2015-7554/ SUSE CVE CVE-2015-7554 page https://www.suse.com/security/cve/CVE-2015-8781/ SUSE CVE CVE-2015-8781 page https://www.suse.com/security/cve/CVE-2015-8782/ SUSE CVE CVE-2015-8782 page https://www.suse.com/security/cve/CVE-2015-8783/ SUSE CVE CVE-2015-8783 page SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-3.8.2-141.163.1 libtiff-devel-32bit-3.8.2-141.163.1 libtiff3-3.8.2-141.163.1 libtiff3-32bit-3.8.2-141.163.1 libtiff3-x86-3.8.2-141.163.1 tiff-3.8.2-141.163.1 libtiff3-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 libtiff3-32bit-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 libtiff3-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-32bit-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-x86-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server 11 SP4 tiff-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-32bit-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-x86-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tiff-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff-devel-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-32bit-3.8.2-141.163.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image. CVE-2015-7554 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.163.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160353-1/ https://www.suse.com/security/cve/CVE-2015-7554.html CVE-2015-7554 https://bugzilla.suse.com/1007276 SUSE Bug 1007276 https://bugzilla.suse.com/1017690 SUSE Bug 1017690 https://bugzilla.suse.com/1040322 SUSE Bug 1040322 https://bugzilla.suse.com/960341 SUSE Bug 960341 https://bugzilla.suse.com/974621 SUSE Bug 974621 https://bugzilla.suse.com/983436 SUSE Bug 983436 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. CVE-2015-8781 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.163.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160353-1/ https://www.suse.com/security/cve/CVE-2015-8781.html CVE-2015-8781 https://bugzilla.suse.com/964213 SUSE Bug 964213 https://bugzilla.suse.com/964225 SUSE Bug 964225 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781. CVE-2015-8782 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.163.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160353-1/ https://www.suse.com/security/cve/CVE-2015-8782.html CVE-2015-8782 https://bugzilla.suse.com/964213 SUSE Bug 964213 https://bugzilla.suse.com/964225 SUSE Bug 964225 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. CVE-2015-8783 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Desktop 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.163.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.163.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.163.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160353-1/ https://www.suse.com/security/cve/CVE-2015-8783.html CVE-2015-8783 https://bugzilla.suse.com/964213 SUSE Bug 964213 https://bugzilla.suse.com/964225 SUSE Bug 964225