This update for tiff fixes the following security issues :

  - CVE-2017-5225: Prevent heap buffer overflow in the     tools/tiffcp that could have caused DoS or code     execution via a crafted BitsPerSample value     (bsc#1019611)

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825)

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332)

  - CVE-2016-10266: Prevent remote attackers to cause a     denial of service (divide-by-zero error and application     crash) via a crafted TIFF image, related to     libtiff/tif_read.c:351:22 (bsc#1031263)

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408)

  - CVE-2016-9540: Prevent out-of-bounds write on tiled     images with odd tile width versus image width     (bsc#1011839).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - Removed assert in readSeparateTilesIntoBuffer() function     (bsc#1017689).

  - CVE-2016-10095: Prevent stack-based buffer overflow in     the _TIFFVGetField function that allowed remote     attackers to cause a denial of service (crash) via a     crafted TIFF file (bsc#1017690).

  - CVE-2016-8331: Prevent remote code execution because of     incorrect handling of TIFF images. A crafted TIFF     document could have lead to a type confusion     vulnerability resulting in remote code execution. This     vulnerability could have been be triggered via a TIFF     file delivered to the application using LibTIFF's tag     extension functionality (bsc#1007276).

  - CVE-2016-3632: The _TIFFVGetField function allowed     remote attackers to cause a denial of service     (out-of-bounds write) or execute arbitrary code via a     crafted TIFF image (bsc#974621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibTiff was updated to the 4.0.4 stable release fixing various security issues and bugs.

These security issues were fixed :

  - CVE-2014-8127: Out-of-bounds write (bnc#914890).

  - CVE-2014-8128: Out-of-bounds write (bnc#914890).

  - CVE-2014-8129: Out-of-bounds write (bnc#914890).

  - CVE-2014-8130: Out-of-bounds write (bnc#914890).

  - CVE-2014-9655: Access of uninitialized memory     (bnc#916927).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libtiff packages are available for Slackware 14.2 and -current to fix security issues.

LibTIFF was updated fix various security issues that could lead to crashes of the image decoder. (CVE-2014-9655, CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130, CVE-2015-1547)

William Robinet and Michal Zalewski discovered multiple vulnerabilities in the TIFF library and its tools, which may result in denial of service or the execution of arbitrary code if a malformed TIFF file is processed.

Version 4.0.2-6+deb7u7 introduced changes that resulted in libtiff being unable to write out tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image.

This problem manifested itself with errors like those: $ tiffcp -r 16
-c jpeg sample.tif out.tif _TIFFVGetField: out.tif: Invalid tag 'Predictor' (not supported by codec). _TIFFVGetField: out.tif: Invalid tag 'BadFaxLines' (not supported by codec). tiffcp:
tif_dirwrite.c:687: TIFFWriteDirectorySec: Assertion `0' failed.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u10.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2553-1 advisory.

    William Robinet discovered that LibTIFF incorrectly handled certain malformed images. If a user or     automated system were tricked into opening a specially crafted image, a remote attacker could crash the     application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
    (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130)

    Paris Zoumpouloglou discovered that LibTIFF incorrectly handled certain malformed BMP images. If a user or     automated system were tricked into opening a specially crafted BMP image, a remote attacker could crash     the application, leading to a denial of service. (CVE-2014-9330)

    Michal Zalewski discovered that LibTIFF incorrectly handled certain malformed images. If a user or     automated system were tricked into opening a specially crafted image, a remote attacker could crash the     application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
    (CVE-2014-9655)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

tiff was updated to fix six security issues found by fuzzing initiatives.

These security issues were fixed :

  - CVE-2014-8127: Out-of-bounds write (bnc#914890).

  - CVE-2014-8128: Out-of-bounds write (bnc#914890).

  - CVE-2014-8129: Out-of-bounds write (bnc#914890).

  - CVE-2014-8130: Out-of-bounds write (bnc#914890).

  - CVE-2014-9655: Access of uninitialized memory     (bnc#916927).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-16 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libTIFF. Please review       the CVE identifier and bug reports referenced for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       image file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The mobile device is running a version of iOS prior to version 8.4. It is, therefore, affected by vulnerabilities in the following components :

  - Application Store
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreGraphics
  - CoreText
  - coreTLS
  - DiskImages
  - FontParser
  - ImageIO
  - Kernel
  - Mail
  - MobileInstallation
  - Safari
  - Security
  - SQLite
  - Telephony
  - WebKit
  - WiFi Connectivity

This update for tiff to version 4.0.9 fixes the following issues :

Security issues fixed :

  - CVE-2014-8128: Fix out-of-bounds read with malformed     TIFF image in multiple tools (bsc#969783).

  - CVE-2015-7554: Fix invalid write in tiffsplit /
    _TIFFVGetField (bsc#960341).

  - CVE-2016-10095: Fix stack-based buffer overflow in
    _TIFFVGetField (tif_dir.c) (bsc#1017690).

  - CVE-2016-5318: Fix stackoverflow in thumbnail     (bsc#983436).

  - CVE-2017-16232: Fix memory-based DoS in tiff2bw     (bsc#1069213).

This update was imported from the SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows     remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
    (CVE-2014-8128)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated libtiff packages fix security vulnerabilities :

The libtiff image decoder library contains several issues that could cause the decoder to crash when reading crafted TIFF images (CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130, CVE-2014-9655, CVE-2015-1547).

tiff was updated to version 4.0.4 to fix six security issues found by fuzzing initiatives.

These security issues were fixed :

  - CVE-2014-8127: Out-of-bounds write (bnc#914890).

  - CVE-2014-9655: Access of uninitialized memory     (bnc#916927).

  - CVE-2014-8130: Out-of-bounds write (bnc#914890).

  - CVE-2015-1547: Use of uninitialized memory in NeXTDecode     (bnc#916925).

  - CVE-2014-8129: Out-of-bounds write (bnc#914890).

  - CVE-2014-8128: Out-of-bounds write (bnc#914890).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
110803	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:1835-1)	Nessus	SuSE Local Security Checks	2018/6/29	2024/9/10	critical
85762	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2015:1475-1)	Nessus	SuSE Local Security Checks	2015/9/3	2021/1/6	high
104702	Slackware 14.2 / current : libtiff (SSA:2017-324-01)	Nessus	Slackware Local Security Checks	2017/11/21	2025/11/13	medium
81719	openSUSE Security Update : tiff (openSUSE-2015-207)	Nessus	SuSE Local Security Checks	2015/3/10	2021/1/19	high
83820	Debian DSA-3273-1 : tiff - security update	Nessus	Debian Local Security Checks	2015/5/27	2021/1/11	high
94474	Debian DLA-693-2 : tiff regression update	Nessus	Debian Local Security Checks	2016/11/3	2026/1/20	critical
82497	Ubuntu 14.04 LTS : LibTIFF vulnerabilities (USN-2553-1)	Nessus	Ubuntu Local Security Checks	2015/4/1	2024/8/28	high
85597	SUSE SLED11 / SLES11 Security Update : tiff (SUSE-SU-2015:1420-1)	Nessus	SuSE Local Security Checks	2015/8/24	2021/1/6	high
96373	GLSA-201701-16 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/10	2026/1/6	critical
84490	Apple iOS < 8.4 Multiple Vulnerabilities (Logjam)	Nessus	Mobile Devices	2015/7/1	2026/3/23	high
106060	openSUSE Security Update : tiff (openSUSE-2018-31)	Nessus	SuSE Local Security Checks	2018/1/16	2025/11/3	critical
218653	Linux Distros Unpatched Vulnerability : CVE-2014-8128	Nessus	Misc.	2025/3/4	2025/9/4	medium
82400	Mandriva Linux Security Advisory : libtiff (MDVSA-2015:147-1)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
84655	openSUSE Security Update : tiff (openSUSE-2015-476)	Nessus	SuSE Local Security Checks	2015/7/13	2021/1/19	high

检测

插件搜索

critical

high

medium

high

high

critical

high

high

critical

high

critical

medium

medium

high