Security Update for tiff3 Package - Multiple Vulnerabilities
Summary
DLA-880-1: tiff3 - security update. Affects tiff3 versions < 3.9.6-11+deb7u4. Fixed in 3.9.6-11+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tiff3 package is a library for handling Tagged Image File Format (TIFF) files. It provides functionality for reading, writing, and manipulating TIFF images. The package is widely used by various applications that deal with image processing and storage. However, multiple vulnerabilities have been discovered in the tiff3 package, which can lead to denial of service (DoS) attacks and other security issues.
Vulnerability Detail
The tiff3 package is affected by several vulnerabilities:
- CVE-2015-8781: A crafted TIFF image with an invalid number of samples per pixel in a LogL compressed format can cause an out-of-bounds write, resulting in a DoS.
- CVE-2015-8782: A crafted TIFF image can trigger out-of-bounds writes, leading to a DoS.
- CVE-2015-8783: A crafted TIFF image can cause out-of-bounds reads, resulting in a DoS.
- CVE-2015-8784: The NeXTDecode function in tif_next.c allows remote attackers to perform an out-of-bounds write via a crafted TIFF image.
- CVE-2016-9533: The tif_pixarlog.c file in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers.
- CVE-2016-9534: An issue in the error code path of TIFFFlushData1() in tif_write.c can lead to a DoS.
- CVE-2016-9535: The tif_predict.h and tif_predict.c files in libtiff 4.0.6 have assertions that can result in assertion failures or buffer overflows when dealing with unusual tile sizes.
These vulnerabilities can be exploited by providing specially crafted TIFF files, potentially leading to crashes, data corruption, or even remote code execution.
How To Fix
Minimum fixed version
3.9.6-11+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tiff3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to the tiff3 package as soon as possible.
Conclusion
The tiff3 package is affected by multiple vulnerabilities that can result in denial of service and other security issues. It is crucial to upgrade to the latest version of the package to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tiff3 →
FAQ
The tiff3 package is a library for handling Tagged Image File Format (TIFF) files. It is used by various applications for image processing and storage.
These vulnerabilities can lead to denial of service (DoS) attacks, crashes, data corruption, and potentially remote code execution if exploited by an attacker.
To fix these vulnerabilities, you should upgrade the tiff3 package to version 3.9.6-11+deb7u4 or later using your package manager.
No, there are no known workarounds for these vulnerabilities. It is crucial to apply the security update to the tiff3 package.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for tiff3.
