Security update for tiff SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3879-1 Final 1 1 2018-11-23T16:06:18Z current 2018-11-23T16:06:18Z 2018-11-23T16:06:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672). - CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257). - CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322). - CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080). - CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186). - CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163). - CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440). - CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448). - CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447) - CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446) - CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-tiff-13878,slessp4-tiff-13878 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ Link for SUSE-SU-2018:3879-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004880.html E-Mail link for SUSE-SU-2018:3879-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1010163 SUSE Bug 1010163 https://bugzilla.suse.com/1014461 SUSE Bug 1014461 https://bugzilla.suse.com/1040080 SUSE Bug 1040080 https://bugzilla.suse.com/1040322 SUSE Bug 1040322 https://bugzilla.suse.com/1074186 SUSE Bug 1074186 https://bugzilla.suse.com/1099257 SUSE Bug 1099257 https://bugzilla.suse.com/1113672 SUSE Bug 1113672 https://bugzilla.suse.com/974446 SUSE Bug 974446 https://bugzilla.suse.com/974447 SUSE Bug 974447 https://bugzilla.suse.com/974448 SUSE Bug 974448 https://bugzilla.suse.com/983440 SUSE Bug 983440 https://www.suse.com/security/cve/CVE-2015-8870/ SUSE CVE CVE-2015-8870 page https://www.suse.com/security/cve/CVE-2016-3619/ SUSE CVE CVE-2016-3619 page https://www.suse.com/security/cve/CVE-2016-3620/ SUSE CVE CVE-2016-3620 page https://www.suse.com/security/cve/CVE-2016-3621/ SUSE CVE CVE-2016-3621 page https://www.suse.com/security/cve/CVE-2016-5319/ SUSE CVE CVE-2016-5319 page https://www.suse.com/security/cve/CVE-2016-9273/ SUSE CVE CVE-2016-9273 page https://www.suse.com/security/cve/CVE-2017-17942/ SUSE CVE CVE-2017-17942 page https://www.suse.com/security/cve/CVE-2017-9117/ SUSE CVE CVE-2017-9117 page https://www.suse.com/security/cve/CVE-2017-9147/ SUSE CVE CVE-2017-9147 page https://www.suse.com/security/cve/CVE-2018-12900/ SUSE CVE CVE-2018-12900 page https://www.suse.com/security/cve/CVE-2018-18661/ SUSE CVE CVE-2018-18661 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-3.8.2-141.169.22.1 libtiff-devel-32bit-3.8.2-141.169.22.1 libtiff3-3.8.2-141.169.22.1 libtiff3-32bit-3.8.2-141.169.22.1 libtiff3-x86-3.8.2-141.169.22.1 tiff-3.8.2-141.169.22.1 libtiff3-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-32bit-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-x86-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server 11 SP4 tiff-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-32bit-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-x86-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tiff-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff-devel-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-32bit-3.8.2-141.169.22.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file. CVE-2015-8870 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2015-8870.html CVE-2015-8870 https://bugzilla.suse.com/1014461 SUSE Bug 1014461 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image. CVE-2016-3619 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2016-3619.html CVE-2016-3619 https://bugzilla.suse.com/1040080 SUSE Bug 1040080 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 https://bugzilla.suse.com/974446 SUSE Bug 974446 https://bugzilla.suse.com/974447 SUSE Bug 974447 https://bugzilla.suse.com/974448 SUSE Bug 974448 The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image. CVE-2016-3620 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2016-3620.html CVE-2016-3620 https://bugzilla.suse.com/1040080 SUSE Bug 1040080 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 https://bugzilla.suse.com/974447 SUSE Bug 974447 The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image. CVE-2016-3621 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2016-3621.html CVE-2016-3621 https://bugzilla.suse.com/1040080 SUSE Bug 1040080 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 https://bugzilla.suse.com/974448 SUSE Bug 974448 Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp file. CVE-2016-5319 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2016-5319.html CVE-2016-5319 https://bugzilla.suse.com/1074186 SUSE Bug 1074186 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 https://bugzilla.suse.com/983440 SUSE Bug 983440 tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF_STRIPCHOP mode. CVE-2016-9273 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2016-9273.html CVE-2016-9273 https://bugzilla.suse.com/1010163 SUSE Bug 1010163 https://bugzilla.suse.com/1017693 SUSE Bug 1017693 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c. CVE-2017-17942 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2017-17942.html CVE-2017-17942 https://bugzilla.suse.com/1074186 SUSE Bug 1074186 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 https://bugzilla.suse.com/983440 SUSE Bug 983440 In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff. CVE-2017-9117 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2017-9117.html CVE-2017-9117 https://bugzilla.suse.com/1040080 SUSE Bug 1040080 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file. CVE-2017-9147 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2017-9147.html CVE-2017-9147 https://bugzilla.suse.com/1040322 SUSE Bug 1040322 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file. CVE-2018-12900 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2018-12900.html CVE-2018-12900 https://bugzilla.suse.com/1099257 SUSE Bug 1099257 https://bugzilla.suse.com/1125113 SUSE Bug 1125113 https://bugzilla.suse.com/1150480 SUSE Bug 1150480 An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. CVE-2018-18661 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.22.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.22.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183879-1/ https://www.suse.com/security/cve/CVE-2018-18661.html CVE-2018-18661 https://bugzilla.suse.com/1113672 SUSE Bug 1113672