Skip to content
OpenAdvisories
High ELSA-2016-1546 19 CVEs

Important: libtiff security update (Oracle Linux 7)

Published Aug 2, 2016 · Updated Aug 2, 2016

Ecosystem: Oracle Linux

Summary

[4.0.3-25]
- Add patches for CVEs:
CVE-2015-7554, CVE-2015-8683, CVE-2015-8665,
CVE-2015-8781, CVE-2015-8782, CVE-2015-8783,
CVE-2015-8784
- Related: #1299920

[4.0.3-24]
- Update patches for CVEs:
CVE-2014-8127, CVE-2014-8130
- Related: #1299920

[4.0.3-23]
- Update patches:
CVE-2014-9330, CVE-2014-8127, CVE-2014-8129
CVE-2014-8130
- Related: #1299920

[4.0.3-22]
- Update patch for CVE-2015-8668
- Related: #1299920

[4.0.3-21]
- Remove patches for CVEs:
CVE-2014-8127, CVE-2014-8129, CVE-2014-8130,
CVE-2014-9330, CVE-2015-7554, CVE-2015-8665,
CVE-2015-8683, CVE-2015-8781, CVE-2015-8784
- Add patches for CVEs:
CVE-2016-3632, CVE-2016-3945, CVE-2016-3990,
CVE-2016-3991, CVE-2016-5320
- Update patches for CVEs:
CVE-2014-9655, CVE-2015-1547, CVE-2015-8668
- Related: #1299920

[4.0.3-20]
- CVE-2014-8127 should contain only two fixes
- Related: #1299920

[4.0.3-19]
- Revert previous patch CVE-2014-8127
- Related: #1299920

[4.0.3-18]
- Fix patch CVE-2014-8127. Wrongly applied
- Related: #1299920

[4.0.3-17]
- Fix patch CVE-2015-8668. Wrongly applied by me
- Related: #1299920

[4.0.3-16]
- Fixed patches on preview CVEs
- Related: #1299920

[4.0.3-15]
- This resolves several CVEs
- CVE-2014-8127, CVE-2014-8129, CVE-2014-8130
- CVE-2014-9330, CVE-2014-9655, CVE-2015-8781
- CVE-2015-8784, CVE-2015-1547, CVE-2015-8683
- CVE-2015-8665, CVE-2015-7554, CVE-2015-8668
- Resolves: #1299920

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 libtiff 0:4.0.3-25.el7_2
Oracle Linux · 7 libtiff-devel 0:4.0.3-25.el7_2
Oracle Linux · 7 libtiff-static 0:4.0.3-25.el7_2
Oracle Linux · 7 libtiff-tools 0:4.0.3-25.el7_2

Vulnerabilities 19

  • Unscored —
    CVE-2014-8127

    LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF im…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2014-8129

    LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified o…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-8130

    The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to c…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-9330

    Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (cr…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2014-9655

    The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-1547

    The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized me…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-7554

    The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8665

    tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the Sampl…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8668 EPSS 14%

    Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8683

    The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of servic…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8781

    tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of sampl…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8782

    tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a d…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8783

    tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8784

    The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds wr…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3632

    The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3945

    Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3990

    Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3991

    Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote at…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-5320 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2…

    tiff tiff Ubuntu Alpine