Medium WID-SEC-2023-2409 8 CVEs

libTIFF: Mehrere Schwachstellen

Published Jun 14, 2016 · Updated Oct 8, 2023 · Revision 21 · de-DE

Vendor: amazon Vendor: Debian Vendor: F5 Vendor: Juniper Networks Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Junos Space < 20.1R1 Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: WebAccelerator Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libTIFF ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder um einen Denial of Service Zustand hervorzurufen.

Product

libTIFF ist ein Softwarepaket für die Verarbeitung von Bilddateien in Tag Image File Format (TIFF).

Vulnerabilities 8

Unscored —

CVE-2016-5314

Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers t…

tiff tiff tiff Debian Ubuntu Alpine

Mar 12, 2018
Unscored —

CVE-2016-5315

The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of servic…

tiff tiff tiff Debian Ubuntu Alpine

Mar 7, 2017
Unscored —

CVE-2016-5316

Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attacke…

tiff tiff tiff Debian Ubuntu Alpine

Jan 20, 2017
Unscored —

CVE-2016-5317

Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlie…

tiff tiff tiff Debian Ubuntu Alpine

Jan 20, 2017
Unscored —

CVE-2016-5320 Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2…

tiff tiff Ubuntu Alpine

Mar 12, 2018
Unscored —

CVE-2016-5321

The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read an…

tiff tiff tiff Debian Ubuntu Alpine

Jan 20, 2017
Unscored —

CVE-2016-5322

The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of servic…

tiff tiff Debian Ubuntu

Apr 11, 2017
Unscored —

CVE-2016-5323

The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-…

tiff tiff tiff Debian Ubuntu Alpine

Jan 20, 2017

Revision history

2023-10-08 #21
Neue Updates von Amazon aufgenommen
2023-09-20 #20
Neue Updates von Amazon aufgenommen
2020-07-08 #19
Neue Updates von Juniper aufgenommen
2018-05-31 #18
New remediations available
2017-08-07 #17
New remediations available
2017-07-19 #16
New remediations available
2017-05-30 #15
New remediations available
2017-02-27 #14
New remediations available
2017-01-15 #13
New remediations available
2016-12-29 #12
New remediations available
2016-11-08 #10
New remediations available
2016-11-08 #11
Version nicht vorhanden
2016-10-13 #9
New remediations available
2016-09-11 #8
New remediations available
2016-08-02 #4
New remediations available
2016-08-02 #5
Version nicht vorhanden
2016-08-02 #6
Version nicht vorhanden
2016-08-02 #7
Version nicht vorhanden
2016-06-14 #1
Initial Release
2016-06-14 #2
Version nicht vorhanden
2016-06-14 #3
Version nicht vorhanden

References

Amazon Linux Security Advisory ALAS-2023-1855 vom 2023-10-06
https://alas.aws.amazon.com/ALAS-2023-1855.html
Amazon Linux Security Advisory ALAS2-2023-2263 vom 2023-09-21
https://alas.aws.amazon.com/AL2/ALAS-2023-2263.html
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/1
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/2
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/3
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/5
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/6
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/7
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/8
OSS Security Mailing List vom 2016-06-14
http://www.openwall.com/lists/oss-security/2016/06/15/9
Red Hat Security Advisory RHSA-2016:1546 vom 2016-08-03
https://rhn.redhat.com/errata/RHSA-2016-1546.html
Red Hat Security Advisory RHSA-2016:1547 vom 2016-08-03
https://rhn.redhat.com/errata/RHSA-2016-1547.html
SUSE Security Update SUSE-SU-2016:2271-1 vom 2016-09-10
https://www.suse.com/support/update/announcement/2016/suse-su-20162271-1.html
SUSE Security Update SUSE-SU-2016:2527-1 vom 2016-10-13
https://www.suse.com/support/update/announcement/2016/suse-su-20162527-1.html
F5 Security Advisory SOL89096577 vom 2016-11-08
https://support.f5.com/kb/en-us/solutions/public/k/89/sol89096577.html
SUSE Security Update SUSE-SU-2016:3301-1 vom 2016-12-30
https://www.suse.com/support/update/announcement/2016/suse-su-20163301-1.html
Debian Security Advisory DSA-3762 vom 2017-01-14
https://www.debian.org/security/2017/dsa-3762
Ubuntu Security Notice USN-3212-1 vom 2017-02-27
http://www.ubuntu.com/usn/usn-3212-1/
Ubuntu Security Notice USN-3212-2 vom 2017-05-30
http://www.ubuntu.com/usn/usn-3212-2/
Ubuntu Security Notice USN-3212-3 vom 2017-07-19
http://www.ubuntu.com/usn/usn-3212-3/
Ubuntu Security Notice USN-3212-4 vom 2017-08-07
http://www.ubuntu.com/usn/usn-3212-4/
SUSE Security Update SUSE-SU-2018:1472-1 vom 2018-05-31
https://www.suse.com/support/update/announcement/2018/suse-su-20181472-1.html
Juniper Security Advisory JSA11023 vom 2020-07-08
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11023