ASA-201811-18 generated external raw

[ASA-201811-18] lib32-libtiff: multiple issues
Arch Linux Security Advisory ASA-201811-18 ========================================== Severity: High Date : 2018-11-20 CVE-ID : CVE-2017-9935 CVE-2017-11613 CVE-2017-18013 CVE-2018-5784 CVE-2018-7456 CVE-2018-8905 CVE-2018-10779 CVE-2018-10963 CVE-2018-18557 CVE-2018-18661 Package : lib32-libtiff Type : multiple issues Remote : Yes Link : Summary ======= The package lib32-libtiff before version 4.0.10-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 4.0.10-1. # pacman -Syu "lib32-libtiff>=4.0.10-1" The problems have been fixed upstream in version 4.0.10. Workaround ========== None. Description =========== - CVE-2017-9935 (arbitrary code execution) In LibTIFF before 4.0.10, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution. - CVE-2017-11613 (denial of service) In LibTIFF before 4.0.10, there is a denial of service vulnerability in the TIFFOpen function triggered by resource consumption via crafted input files. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. - CVE-2017-18013 (denial of service) A null-pointer dereference issue has been found in libtiff before 4.0.10, in the TIFFPrintDirectory() function in tiffinfo.c, while parsing the "1 Strips: " section of a crafted image, as demonstrated by a tiffinfo tool crash. - CVE-2018-5784 (denial of service) In LibTIFF before 4.0.10, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries. - CVE-2018-7456 (denial of service) A null pointer dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF before 4.0.10 when using the tiffinfo tool to print crafted TIFF information. - CVE-2018-8905 (arbitrary code execution) In LibTIFF before 4.0.10, a heap-based buffer overflow (out-of-bounds write) occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by the tiff2ps tool. - CVE-2018-10779 (information disclosure) A heap-based out-of-bounds read has been found in libtiff before 4.0.10, in the TIFFWriteScanline() function. The issue is caused by a uint32_t overflow on 32-bit systems. - CVE-2018-10963 (denial of service) The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF before 4.0.10 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file. - CVE-2018-18557 (arbitrary code execution) LibTIFF before 4.0.10 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write. - CVE-2018-18661 (denial of service) A null-pointer dereference has been found in LibTIFF before 4.0.10 in the LZWDecode() function in the file tif_lzw.c. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host via a crafted picture file. References ==========