Synopsis

Important: libtiff security update

Type/Severity

Security Advisory: Important

Topic

An update for libtiff is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547, CVE-2015-8784, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2016-3990, CVE-2016-5320)
• Multiple flaws have been discovered in various libtiff tools (bmp2tiff, pal2rgb, thumbnail, tiff2bw, tiff2pdf, tiffcrop, tiffdither, tiffsplit, tiff2rgba). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2014-8127, CVE-2014-8129, CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632, CVE-2016-3945, CVE-2016-3991)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 1177893 - CVE-2014-9330 libtiff: Out-of-bounds reads followed by a crash in bmp2tiff
• BZ - 1185805 - CVE-2014-8127 libtiff: out-of-bounds read with malformed TIFF image in multiple tools
• BZ - 1185815 - CVE-2014-8129 libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf
• BZ - 1185817 - CVE-2014-8130 libtiff: divide by zero in the tiffdither tool
• BZ - 1190703 - CVE-2014-9655 libtiff: use of uninitialized memory in putcontig8bitYCbCr21tile and NeXTDecode
• BZ - 1190709 - CVE-2015-1547 libtiff: use of uninitialized memory in NeXTDecode
• BZ - 1294417 - CVE-2015-7554 libtiff: Invalid-write in _TIFFVGetField() when parsing some extension tags
• BZ - 1294425 - CVE-2015-8668 libtiff: OOB read in bmp2tiff
• BZ - 1294427 - CVE-2015-8683 libtiff: Out-of-bounds when reading CIE Lab image format files
• BZ - 1294444 - CVE-2015-8665 libtiff: Out-of-bounds read in tif_getimage.c
• BZ - 1301649 - CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 libtiff: invalid assertion
• BZ - 1301652 - CVE-2015-8784 libtiff: out-of-bound write in NeXTDecode()
• BZ - 1325093 - CVE-2016-3945 libtiff: out-of-bounds write in the tiff2rgba tool
• BZ - 1325095 - CVE-2016-3632 libtiff: out-of-bounds write in _TIFFVGetField function
• BZ - 1326246 - CVE-2016-3990 libtiff: out-of-bounds write in horizontalDifference8()
• BZ - 1326249 - CVE-2016-3991 libtiff: out-of-bounds write in loadImage() function
• BZ - 1346687 - CVE-2016-5320 libtiff: Out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c

CVEs

• CVE-2014-8127
• CVE-2014-8129
• CVE-2014-8130
• CVE-2014-9330
• CVE-2014-9655
• CVE-2015-1547
• CVE-2015-7554
• CVE-2015-8665
• CVE-2015-8668
• CVE-2015-8683
• CVE-2015-8781
• CVE-2015-8782
• CVE-2015-8783
• CVE-2015-8784
• CVE-2016-3632
• CVE-2016-3945
• CVE-2016-3990
• CVE-2016-3991
• CVE-2016-5320

References