Several vulnerabilities have been found in tiff, a Tag Image File Format library. Multiple out-of-bounds read and write flaws could cause an application using the tiff library to crash.

This update for tiff fixes the following issues :

  - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783:
    Out-of-bounds writes for invalid images (bsc#964225)

  - CVE-2016-3186: Buffer overflow in gif2tiff (bnc#973340).

  - CVE-2016-5875: heap-based buffer overflow when using the     PixarLog compressionformat (bsc#987351)

  - CVE-2016-5316: Out-of-bounds read in PixarLogCleanup()     function in tif_pixarlog.c (bsc#984837)

  - CVE-2016-5314: Out-of-bounds write in PixarLogDecode()     function (bsc#984831)

  - CVE-2016-5317: Out-of-bounds write in PixarLogDecode()     function in libtiff.so (bsc#984842)

  - CVE-2016-5320: Out-of-bounds write in PixarLogDecode()     function in tif_pixarlog.c (bsc#984808)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

  - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783:
    Out-of-bounds writes for invalid images (bsc#964225)

  - CVE-2016-3186: Buffer overflow in gif2tiff (bnc#973340).

  - CVE-2016-5875: heap-based buffer overflow when using the     PixarLog compressionformat (bsc#987351)

  - CVE-2016-5316: Out-of-bounds read in PixarLogCleanup()     function in tif_pixarlog.c (bsc#984837)

  - CVE-2016-5314: Out-of-bounds write in PixarLogDecode()     function (bsc#984831)

  - CVE-2016-5317: Out-of-bounds write in PixarLogDecode()     function in libtiff.so (bsc#984842)

  - CVE-2016-5320: Out-of-bounds write in PixarLogDecode()     function in tif_pixarlog.c (bsc#984808)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws have been discovered in libtiff. A     remote attacker could exploit these flaws to cause a     crash or memory corruption and, possibly, execute     arbitrary code by tricking an application linked     against libtiff into processing specially crafted     files.(CVE-2014-9655, CVE-2015-1547, CVE-2015-8784,     CVE-2015-8683, CVE-2015-8665, CVE-2015-8781,     CVE-2015-8782, CVE-2015-8783, CVE-2016-3990,     CVE-2016-5320)

  - Multiple flaws have been discovered in various libtiff     tools (bmp2tiff, pal2rgb, thumbnail, tiff2bw, tiff2pdf,     tiffcrop, tiffdither, tiffsplit, tiff2rgba). By     tricking a user into processing a specially crafted     file, a remote attacker could exploit these flaws to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff tool.(CVE-2014-8127, CVE-2014-8129,     CVE-2014-8130, CVE-2014-9330, CVE-2015-7554,     CVE-2015-8668, CVE-2016-3632, CVE-2016-3945,     CVE-2016-3991)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update patch for (CVE-2014-8127)

  - Related: #1335099

  - Fix patches for (CVE-2016-3990, CVE-2016-5320)

  - Related: #1335099

  - Add patches for CVEs :

  - CVE-2016-3632 CVE-2016-3945 (CVE-2016-3990)

  - CVE-2016-3991 (CVE-2016-5320)

  - Related: #1335099

  - Update patch for (CVE-2014-8129)

  - Related: #1335099

  - Merge previously released fixes for CVEs :

  - CVE-2013-1960 CVE-2013-1961 (CVE-2013-4231)

  - CVE-2013-4232 CVE-2013-4243 (CVE-2013-4244)

  - Resolves: #1335099

  - Patch typos in (CVE-2014-8127)

  - Related: #1299919

  - Fix CVE-2014-8127 and CVE-2015-8668 patches

  - Related: #1299919

  - Fixed patches on preview CVEs

  - Related: #1299919

  - This resolves several CVEs

  - CVE-2014-8127, CVE-2014-8129, (CVE-2014-8130)

  - CVE-2014-9330, CVE-2014-9655, (CVE-2015-8781)

  - CVE-2015-8784, CVE-2015-1547, (CVE-2015-8683)

  - CVE-2015-8665, CVE-2015-7554, (CVE-2015-8668)

  - Resolves: #1299919

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2016:1546-1 advisory.

    Security Fix(es):
    * Multiple flaws have been discovered in libtiff. A remote attacker could     exploit these flaws to cause a crash or memory corruption and, possibly,     execute arbitrary code by tricking an application linked against libtiff     into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547,     CVE-2015-8784, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782,     CVE-2015-8783, CVE-2016-3990, CVE-2016-5320)
    * Multiple flaws have been discovered in various libtiff tools (bmp2tiff,     pal2rgb, thumbnail, tiff2bw, tiff2pdf, tiffcrop, tiffdither, tiffsplit,     tiff2rgba). By tricking a user into processing a specially crafted file, a     remote attacker could exploit these flaws to cause a crash or memory     corruption and, possibly, execute arbitrary code with the privileges of     the user running the libtiff tool. (CVE-2014-8127, CVE-2014-8129,     CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632,     CVE-2016-3945, CVE-2016-3991)


Tenable has extracted the preceding description block directly from the Scientific Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tiff fixes the following issues :

  - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783:
    Out-of-bounds writes for invalid images (bsc#964225)

  - CVE-2016-3186: Buffer overflow in gif2tiff (bnc#973340).

  - CVE-2016-5875: heap-based buffer overflow when using the     PixarLog compressionformat (bsc#987351)

  - CVE-2016-5316: Out-of-bounds read in PixarLogCleanup()     function in tif_pixarlog.c (bsc#984837)

  - CVE-2016-5314: Out-of-bounds write in PixarLogDecode()     function (bsc#984831)

  - CVE-2016-5317: Out-of-bounds write in PixarLogDecode()     function in libtiff.so (bsc#984842)

  - CVE-2016-5320: Out-of-bounds write in PixarLogDecode()     function in tif_pixarlog.c (bsc#984808) 

This update was imported from the SUSE:SLE-12:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
88601	Debian DSA-3467-1 : tiff - security update	Nessus	Debian Local Security Checks	2016/2/8	2021/1/11	medium
93439	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2016:2271-1)	Nessus	SuSE Local Security Checks	2016/9/12	2026/1/26	high
93707	openSUSE Security Update : tiff (openSUSE-2016-1122)	Nessus	SuSE Local Security Checks	2016/9/26	2026/1/23	high
99797	EulerOS 2.0 SP1 : libtiff (EulerOS-SA-2016-1034)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical
92691	OracleVM 3.3 / 3.4 : libtiff (OVMSA-2016-0093)	Nessus	OracleVM Local Security Checks	2016/8/3	2026/1/29	critical
92720	Scientific Linux Security Update : libtiff on 7.x i686/x86_64 (2016:1546)	Nessus	Scientific Linux Local Security Checks	2016/8/4	2025/8/29	critical
93585	openSUSE Security Update : tiff (openSUSE-2016-1089)	Nessus	SuSE Local Security Checks	2016/9/19	2026/1/23	high

检测

插件搜索

medium

high

high

critical

critical

critical

high