In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a     DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign     extended to an integer that produces more digits than expected in an sprintf call. (CVE-2006-2193)

  - Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-     dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG     stream that is longer than the scan line size (TiffScanLineSize). (CVE-2006-3460)

  - Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors. (CVE-2006-3461)

  - Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE     images. (CVE-2006-3462)

  - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short     when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial     of service via a large td_nstrips value, which triggers an infinite loop. (CVE-2006-3463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tiff fixes the following security issues :

These security issues were fixed :

  - CVE-2017-18013: Fixed a NULL pointer dereference in the     tif_print.cTIFFPrintDirectory function that could have     lead to denial of service (bsc#1074317).

  - CVE-2018-10963: Fixed an assertion failure in the     TIFFWriteDirectorySec() function in tif_dirwrite.c,     which allowed remote attackers to cause a denial of     service via a crafted file (bsc#1092949).

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825).

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332).

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the libtiff package has been released.

Added fixes for :

  - **CVE-2017-9935**

  - **CVE-2017-18013**

  - **CVE-2018-8905**

  - **CVE-2018-10963**

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following security issues: These security issues were fixed :

  - CVE-2017-18013: Fixed a NULL pointer dereference in the     tif_print.cTIFFPrintDirectory function that could have     lead to denial of service (bsc#1074317).

  - CVE-2018-10963: Fixed an assertion failure in the     TIFFWriteDirectorySec() function in tif_dirwrite.c,     which allowed remote attackers to cause a denial of     service via a crafted file (bsc#1092949).

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825).

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332).

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following security issues :

  - CVE-2017-5225: Prevent heap buffer overflow in the     tools/tiffcp that could have caused DoS or code     execution via a crafted BitsPerSample value     (bsc#1019611)

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825)

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332)

  - CVE-2016-10266: Prevent remote attackers to cause a     denial of service (divide-by-zero error and application     crash) via a crafted TIFF image, related to     libtiff/tif_read.c:351:22 (bsc#1031263)

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408)

  - CVE-2016-9540: Prevent out-of-bounds write on tiled     images with odd tile width versus image width     (bsc#1011839).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - Removed assert in readSeparateTilesIntoBuffer() function     (bsc#1017689).

  - CVE-2016-10095: Prevent stack-based buffer overflow in     the _TIFFVGetField function that allowed remote     attackers to cause a denial of service (crash) via a     crafted TIFF file (bsc#1017690).

  - CVE-2016-8331: Prevent remote code execution because of     incorrect handling of TIFF images. A crafted TIFF     document could have lead to a type confusion     vulnerability resulting in remote code execution. This     vulnerability could have been be triggered via a TIFF     file delivered to the application using LibTIFF's tag     extension functionality (bsc#1007276).

  - CVE-2016-3632: The _TIFFVGetField function allowed     remote attackers to cause a denial of service     (out-of-bounds write) or execute arbitrary code via a     crafted TIFF image (bsc#974621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

These security issues were fixed :

  - CVE-2017-18013: There was a NULL pointer Dereference in     the tif_print.c TIFFPrintDirectory function, as     demonstrated by a tiffinfo crash. (bsc#1074317)

  - CVE-2018-10963: The TIFFWriteDirectorySec() function in     tif_dirwrite.c allowed remote attackers to cause a     denial of service (assertion failure and application     crash) via a crafted file, a different vulnerability     than CVE-2017-13726. (bsc#1092949)

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825)

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332)

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408)

  - CVE-2016-8331: Prevent remote code execution because of     incorrect handling of TIFF images. A crafted TIFF     document could have lead to a type confusion     vulnerability resulting in remote code execution. This     vulnerability could have been be triggered via a TIFF     file delivered to the application using LibTIFF's tag     extension functionality (bsc#1007276)

  - CVE-2016-3632: The _TIFFVGetField function allowed     remote attackers to cause a denial of service     (out-of-bounds write) or execute arbitrary code via a     crafted TIFF image (bsc#974621)

This update was imported from the SUSE:SLE-12:Update update project.

This update for tiff fixes the following issues: These security issues were fixed :

  - CVE-2017-18013: There was a NULL pointer Dereference in     the tif_print.c TIFFPrintDirectory function, as     demonstrated by a tiffinfo crash. (bsc#1074317)

  - CVE-2018-10963: The TIFFWriteDirectorySec() function in     tif_dirwrite.c allowed remote attackers to cause a     denial of service (assertion failure and application     crash) via a crafted file, a different vulnerability     than CVE-2017-13726. (bsc#1092949)

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825)

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332)

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408)

  - CVE-2016-8331: Prevent remote code execution because of     incorrect handling of TIFF images. A crafted TIFF     document could have lead to a type confusion     vulnerability resulting in remote code execution. This     vulnerability could have been be triggered via a TIFF     file delivered to the application using LibTIFF's tag     extension functionality (bsc#1007276)

  - CVE-2016-3632: The _TIFFVGetField function allowed     remote attackers to cause a denial of service     (out-of-bounds write) or execute arbitrary code via a     crafted TIFF image (bsc#974621)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues: Security issues fixed :

  - CVE-2016-5315: The setByteArray function in tif_dir.c     allowed remote attackers to cause a denial of service     (out-of-bounds read) via a crafted tiff image.
    (bsc#984809)

  - CVE-2016-10267: LibTIFF allowed remote attackers to     cause a denial of service (divide-by-zero error and     application crash) via a crafted TIFF image, related to     libtiff/tif_ojpeg.c:816:8. (bsc#1017694)

  - CVE-2016-10269: LibTIFF allowed remote attackers to     cause a denial of service (heap-based buffer over-read)     or possibly have unspecified other impact via a crafted     TIFF image, related to 'READ of size 512' and     libtiff/tif_unix.c:340:2. (bsc#1031254)

  - CVE-2016-10270: LibTIFF allowed remote attackers to     cause a denial of service (heap-based buffer over-read)     or possibly have unspecified other impact via a crafted     TIFF image, related to 'READ of size 8' and     libtiff/tif_read.c:523:22. (bsc#1031250)

  - CVE-2017-18013: In LibTIFF, there was a NULL pointer     Dereference in the tif_print.c TIFFPrintDirectory     function, as demonstrated by a tiffinfo crash.
    (bsc#1074317)

  - CVE-2017-7593: tif_read.c did not ensure that     tif_rawdata is properly initialized, which might have     allowed remote attackers to obtain sensitive information     from process memory via a crafted image. (bsc#1033129)

  - CVE-2017-7595: The JPEGSetupEncode function in     tiff_jpeg.c allowed remote attackers to cause a denial     of service (divide-by-zero error and application crash)     via a crafted image. (bsc#1033127)

  - CVE-2017-7596: LibTIFF had an 'outside the range of     representable values of type float' undefined behavior     issue, which might have allowed remote attackers to     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     image. (bsc#1033126)

  - CVE-2017-7597: tif_dirread.c had an 'outside the range     of representable values of type float' undefined     behavior issue, which might have allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image. (bsc#1033120)

  - CVE-2017-7599: LibTIFF had an 'outside the range of     representable values of type short' undefined behavior     issue, which might have allowed remote attackers to     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     image. (bsc#1033113)

  - CVE-2017-7600: LibTIFF had an 'outside the range of     representable values of type unsigned char' undefined     behavior issue, which might have allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted image. (bsc#1033112)

  - CVE-2017-7601: LibTIFF had a 'shift exponent too large     for 64-bit type long' undefined behavior issue, which     might have allowed remote attackers to cause a denial of     service (application crash) or possibly have unspecified     other impact via a crafted image. (bsc#1033111)

  - CVE-2017-7602: LibTIFF had a signed integer overflow,     which might have allowed remote attackers to cause a     denial of service (application crash) or possibly have     unspecified other impact via a crafted image.
    (bsc#1033109)

  - Multiple divide by zero issues

  - CVE-2016-5314: Buffer overflow in the PixarLogDecode     function in tif_pixarlog.c allowed remote attackers to     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     TIFF image, as demonstrated by overwriting the     vgetparent function pointer with rgb2ycbcr. (bsc#987351     bsc#984808 bsc#984831)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3606-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3602-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Debian Security Advisory reports :

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

A vulnerability has been discovered in the libtiff image processing library which may result in an application crash and denial of service.

CVE-2017-18013

NULL pointer dereference via crafted TIFF image

For Debian 7 'Wheezy', these problems have been fixed in version 3.9.6-11+deb7u9.

We recommend that you upgrade your tiff3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in the libtiff image processing library which may result in an application crash and denial of service.

CVE-2017-18013

NULL pointer dereference via crafted TIFF image

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u18.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
206852	NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)	Nessus	NewStart CGSL Local Security Checks	high
123213	openSUSE Security Update : tiff (openSUSE-2019-508)	Nessus	SuSE Local Security Checks	high
121910	Photon OS 2.0: Libtiff PHSA-2018-2.0-0013	Nessus	PhotonOS Local Security Checks	high
120824	Fedora 28 : libtiff (2018-d41d114d3e)	Nessus	Fedora Local Security Checks	high
120035	SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2018:1889-1)	Nessus	SuSE Local Security Checks	high
111099	openSUSE Security Update : tiff (openSUSE-2018-728)	Nessus	SuSE Local Security Checks	high
110803	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:1835-1)	Nessus	SuSE Local Security Checks	critical
110802	openSUSE Security Update : tiff (openSUSE-2018-677)	Nessus	SuSE Local Security Checks	high
110763	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:1826-1)	Nessus	SuSE Local Security Checks	high
110388	Fedora 27 : libtiff (2018-44c6f91560)	Nessus	Fedora Local Security Checks	high
110258	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:1472-1)	Nessus	SuSE Local Security Checks	high
108657	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3606-1)	Nessus	Ubuntu Local Security Checks	critical
108513	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3602-1)	Nessus	Ubuntu Local Security Checks	high
106700	FreeBSD : tiff -- multiple vulnerabilities (b38e8150-0535-11e8-96ab-0800271d4b9c)	Nessus	FreeBSD Local Security Checks	high
106414	Debian DSA-4100-1 : tiff - security update	Nessus	Debian Local Security Checks	high
106410	Debian DLA-1260-1 : tiff3 security update	Nessus	Debian Local Security Checks	medium
106409	Debian DLA-1259-1 : tiff security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-18013

medium

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high

high

critical

high

high

high

medium

medium