shield Security update for tiff

SUSE-SLE-Module-Desktop-Applications-15-2018-2392

This update for tiff fixes the following issues: Security issue fixed: - CVE-2018-10779: TIFFWriteScanline in tif_write.c had a heap-based buffer over-read, as demonstrated by bmp2tiff.(bsc#1092480) - CVE-2018-17100: There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108637) - CVE-2018-17101: There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108627) - CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. (bsc#1110358) - CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. (bsc#1106853)

• Release Date
  Oct 23 2018
• References
  Bugzilla: 1092480, 1108637, 1108627, 1110358, 1106853
  CVEs: CVE-2018-10779, CVE-2018-17100, CVE-2018-17101, CVE-2018-17795, CVE-2018-16335
• Type
  security
• Severity
  moderate

cloud_download Downloads

Desktop Applications Module 15 x86_64

• Packages
  libtiff5-32bit
  The Tiff Library (with JPEG and compression support)

  4.0.9-5.14.1 lock rpm

  tiff
  Tools for Converting from and to the Tagged Image File Format

  4.0.9-5.14.1 lock src