Detections
Analytics

SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2022:3690-1)

medium Nessus Plugin ID 166418

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3690-1 advisory.

 - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
 (CVE-2022-0561)

 - There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 (CVE-2022-2519)

 - A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. (CVE-2022-2520)

 - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. (CVE-2022-2521)

 - libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. (CVE-2022-2867)

 - libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. (CVE-2022-2868)

 - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. (CVE-2022-2869)

 - The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. (CVE-2022-34266)

 - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the tiffsplit or tiffcrop utilities. (CVE-2022-34526)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtiff-devel, libtiff5 and / or libtiff5-32bit packages.

See Also

https://bugzilla.suse.com/1201723

https://bugzilla.suse.com/1201971

https://bugzilla.suse.com/1202026

https://bugzilla.suse.com/1202466

https://bugzilla.suse.com/1202467

https://bugzilla.suse.com/1202468

https://bugzilla.suse.com/1202968

https://bugzilla.suse.com/1202971

https://bugzilla.suse.com/1202973

https://www.suse.com/security/cve/CVE-2022-0561

https://www.suse.com/security/cve/CVE-2022-2519

https://www.suse.com/security/cve/CVE-2022-2520

https://www.suse.com/security/cve/CVE-2022-2521

https://www.suse.com/security/cve/CVE-2022-2867

https://www.suse.com/security/cve/CVE-2022-2868

https://www.suse.com/security/cve/CVE-2022-2869

https://www.suse.com/security/cve/CVE-2022-34266

https://www.suse.com/security/cve/CVE-2022-34526

http://www.nessus.org/u?b7d7097a

Plugin Details

Severity: Medium

ID: 166418

File Name: suse_SU-2022-3690-1.nasl

Version: 1.9

Type: local

Agent: unix

Published: 10/22/2022

Updated: 7/14/2023

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-0561

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-34526

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libtiff-devel, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libtiff5, p-cpe:/a:novell:suse_linux:libtiff5-32bit

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/21/2022

Vulnerability Publication Date: 2/11/2022

Reference Information

CVE: CVE-2022-0561, CVE-2022-2519, CVE-2022-2520, CVE-2022-2521, CVE-2022-2867, CVE-2022-2868, CVE-2022-2869, CVE-2022-34266, CVE-2022-34526

SuSE: SUSE-SU-2022:3690-1