Arch Linux update for libtiff



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2017-9935
CVE-2017-11613
CVE-2018-18557
CVE-2018-18661
CWE-ID CWE-119
CWE-20
CWE-787
CWE-476
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 Arch Linux
Operating systems & Components / Operating system

Vendor Arch Linux

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Memory corruption

EUVDB-ID: #VU11499

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-9935

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the t2p_write_pdf function in tools/tiff2pdf.c due to heap-based buffer overflow. A remote attacker can submit a specially crafted TIFF document, trigger out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package libtiff to version 4.0.10-1.

Vulnerable software versions

Arch Linux: All versions

CPE2.3 External links

https://security.archlinux.org/advisory/ASA-201811-17


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU11494

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-11613

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the TIFFOpen function due to improper checking of td_imagelength during the TIFFOpen process. A remote attacker can cause the service to crash.

Mitigation

Update the affected package libtiff to version 4.0.10-1.

Vulnerable software versions

Arch Linux: All versions

CPE2.3 External links

https://security.archlinux.org/advisory/ASA-201811-17


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU15967

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2018-18557

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to decoding of arbitrarily-sized JBIG into a buffer, ignoring the buffer size. A remote unauthenticated attacker can supply specially crafted input, trigger a tif_jbig.c JBIGDecode out-of-bounds write and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package libtiff to version 4.0.10-1.

Vulnerable software versions

Arch Linux: All versions

CPE2.3 External links

https://security.archlinux.org/advisory/ASA-201811-17


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Null pointer dereference

EUVDB-ID: #VU15901

Risk: Low

CVSSv4.0: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-18661

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. A remote attacker can trick the victim into opening a specially crafted input, trigger NULL pointer dereference and cause the service to crash.

Mitigation

Update the affected package libtiff to version 4.0.10-1.

Vulnerable software versions

Arch Linux: All versions

CPE2.3 External links

https://security.archlinux.org/advisory/ASA-201811-17


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###