[manjaro-security] [ASA-201811-18] lib32-libtiff: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201811-18
==========================================

Severity: High
Date    : 2018-11-20
CVE-ID  : CVE-2017-9935  CVE-2017-11613 CVE-2017-18013 CVE-2018-5784
          CVE-2018-7456  CVE-2018-8905  CVE-2018-10779 CVE-2018-10963
          CVE-2018-18557 CVE-2018-18661
Package : lib32-libtiff
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-791

Summary
=======

The package lib32-libtiff before version 4.0.10-1 is vulnerable to
multiple issues including arbitrary code execution, denial of service
and information disclosure.

Resolution
==========

Upgrade to 4.0.10-1.

# pacman -Syu "lib32-libtiff>=4.0.10-1"

The problems have been fixed upstream in version 4.0.10.

Workaround
==========

None.

Description
===========

- CVE-2017-9935 (arbitrary code execution)

In LibTIFF before 4.0.10, there is a heap-based buffer overflow in the
t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could
lead to different damages. For example, a crafted TIFF document can
lead to an out-of-bounds read in TIFFCleanup, an invalid free in
TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or
a double free in t2p_free. Given these possibilities, it probably could
cause arbitrary code execution.

- CVE-2017-11613 (denial of service)

In LibTIFF before 4.0.10, there is a denial of service vulnerability in
the TIFFOpen function triggered by resource consumption via crafted
input files. During the TIFFOpen process, td_imagelength is not
checked. The value of td_imagelength can be directly controlled by an
input file. In the ChopUpSingleUncompressedStrip function, the
_TIFFCheckMalloc function is called based on td_imagelength. If we set
the value of td_imagelength close to the amount of system memory, it
will hang the system or trigger the OOM killer.

- CVE-2017-18013 (denial of service)

A null-pointer dereference issue has been found in libtiff before
4.0.10, in the TIFFPrintDirectory() function in tiffinfo.c, while
parsing the "1 Strips: " section of a crafted image, as demonstrated by
a tiffinfo tool crash.

- CVE-2018-5784 (denial of service)

In LibTIFF before 4.0.10, there is an uncontrolled resource consumption
in the TIFFSetDirectory function of tif_dir.c. Remote attackers could
leverage this vulnerability to cause a denial of service via a crafted
tif file. This occurs because the declared number of directory entries
is not validated against the actual number of directory entries.

- CVE-2018-7456 (denial of service)

A null pointer dereference occurs in the function TIFFPrintDirectory in
tif_print.c in LibTIFF before 4.0.10 when using the tiffinfo tool to
print crafted TIFF information.

- CVE-2018-8905 (arbitrary code execution)

In LibTIFF before 4.0.10, a heap-based buffer overflow (out-of-bounds
write) occurs in the function LZWDecodeCompat in tif_lzw.c via a
crafted TIFF file, as demonstrated by the tiff2ps tool.

- CVE-2018-10779 (information disclosure)

A heap-based out-of-bounds read has been found in libtiff before
4.0.10, in the TIFFWriteScanline() function. The issue is caused by a
uint32_t overflow on 32-bit systems.

- CVE-2018-10963 (denial of service)

The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF
before 4.0.10 allows remote attackers to cause a denial of service
(assertion failure and application crash) via a crafted file.

- CVE-2018-18557 (arbitrary code execution)

LibTIFF before 4.0.10 (with JBIG enabled) decodes arbitrarily-sized
JBIG into a buffer, ignoring the buffer size, which leads to a
tif_jbig.c JBIGDecode out-of-bounds write.

- CVE-2018-18661 (denial of service)

A null-pointer dereference has been found in LibTIFF before 4.0.10 in
the LZWDecode() function in the file tif_lzw.c.

Impact
======

A remote attacker might be able to cause a denial of service or execute
arbitrary code on the affected host via a crafted picture file.

References
==========

https://bugs.archlinux.org/task/60599
http://bugzilla.maptools.org/show_bug.cgi?id=2704
https://gitlab.com/libtiff/libtiff/commit/5848777bd7e4f465681a7c4d0acf96a1dbd5b75c
http://bugzilla.maptools.org/show_bug.cgi?id=2724
https://gitlab.com/libtiff/libtiff/commit/3719385a3fac5cfb20b487619a5f08abbf967cf8
https://gitlab.com/libtiff/libtiff/commit/7a092f8af2568d61993a8cc2e7a35a998d7d37be
http://bugzilla.maptools.org/show_bug.cgi?id=2770
https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01
http://bugzilla.maptools.org/show_bug.cgi?id=2772
https://gitlab.com/libtiff/libtiff/commit/473851d211cf8805a161820337ca74cc9615d6ef
https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b
http://bugzilla.maptools.org/show_bug.cgi?id=2780
https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d
http://bugzilla.maptools.org/show_bug.cgi?id=2788
https://gitlab.com/libtiff/libtiff/commit/981e43ecae83935625c86c9118c0778c942c7048
http://bugzilla.maptools.org/show_bug.cgi?id=2795
https://gitlab.com/libtiff/libtiff/commit/de144fd228e4be8aa484c3caf3d814b6fa88c6d9
https://bugs.chromium.org/p/project-zero/issues/detail?id=1697
https://gitlab.com/libtiff/libtiff/merge_requests/38
https://gitlab.com/libtiff/libtiff/commit/681748ec2f5ce88da5f9fa6831e1653e46af8a66
http://bugzilla.maptools.org/show_bug.cgi?id=2819
https://gitlab.com/libtiff/libtiff/commit/99b10edde9a0fc28cc0e7b7757aa18ac4c8c225f
https://security.archlinux.org/CVE-2017-9935
https://security.archlinux.org/CVE-2017-11613
https://security.archlinux.org/CVE-2017-18013
https://security.archlinux.org/CVE-2018-5784
https://security.archlinux.org/CVE-2018-7456
https://security.archlinux.org/CVE-2018-8905
https://security.archlinux.org/CVE-2018-10779
https://security.archlinux.org/CVE-2018-10963
https://security.archlinux.org/CVE-2018-18557
https://security.archlinux.org/CVE-2018-18661

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20181123/02633cf9/attachment.sig>