Security update for tiff SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:4120-1 Final 1 1 2018-12-14T09:57:13Z current 2018-12-14T09:57:13Z 2018-12-14T09:57:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tiff This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc function (bsc#1017693). - CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy function (bsc#1017693). - CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits function (bsc#1017693). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-tiff-13910,slessp4-tiff-13910 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20184120-1/ Link for SUSE-SU-2018:4120-1 https://lists.suse.com/pipermail/sle-security-updates/2018-December/004962.html E-Mail link for SUSE-SU-2018:4120-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1017693 SUSE Bug 1017693 https://www.suse.com/security/cve/CVE-2016-10092/ SUSE CVE CVE-2016-10092 page https://www.suse.com/security/cve/CVE-2016-10093/ SUSE CVE CVE-2016-10093 page https://www.suse.com/security/cve/CVE-2016-10094/ SUSE CVE CVE-2016-10094 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-3.8.2-141.169.26.1 libtiff-devel-32bit-3.8.2-141.169.26.1 libtiff3-3.8.2-141.169.26.1 libtiff3-32bit-3.8.2-141.169.26.1 libtiff3-x86-3.8.2-141.169.26.1 tiff-3.8.2-141.169.26.1 libtiff3-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-32bit-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-x86-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server 11 SP4 tiff-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtiff3-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-32bit-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff3-x86-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tiff-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libtiff-devel-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libtiff-devel-32bit-3.8.2-141.169.26.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image. CVE-2016-10092 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.26.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20184120-1/ https://www.suse.com/security/cve/CVE-2016-10092.html CVE-2016-10092 https://bugzilla.suse.com/1017693 SUSE Bug 1017693 https://bugzilla.suse.com/1122679 SUSE Bug 1122679 Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow. CVE-2016-10093 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.26.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20184120-1/ https://www.suse.com/security/cve/CVE-2016-10093.html CVE-2016-10093 https://bugzilla.suse.com/1017693 SUSE Bug 1017693 https://bugzilla.suse.com/1122679 SUSE Bug 1122679 Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image. CVE-2016-10094 SUSE Linux Enterprise Server 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-32bit-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libtiff3-x86-3.8.2-141.169.26.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tiff-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-3.8.2-141.169.26.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libtiff-devel-32bit-3.8.2-141.169.26.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20184120-1/ https://www.suse.com/security/cve/CVE-2016-10094.html CVE-2016-10094 https://bugzilla.suse.com/1017693 SUSE Bug 1017693 https://bugzilla.suse.com/1122679 SUSE Bug 1122679