SUSE-SU-2017:2569-1: moderate: Security update for tiff

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Tue Sep 26 07:08:37 MDT 2017


   SUSE Security Update: Security update for tiff
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:2569-1
Rating:             moderate
References:         #1033109 #1033111 #1033112 #1033113 #1033118 
                    #1033120 #1033126 #1033127 #1033128 #1033129 
                    #1033131 #1038438 #1042804 #1042805 
Cross-References:   CVE-2016-10371 CVE-2017-7592 CVE-2017-7593
                    CVE-2017-7594 CVE-2017-7595 CVE-2017-7596
                    CVE-2017-7597 CVE-2017-7598 CVE-2017-7599
                    CVE-2017-7600 CVE-2017-7601 CVE-2017-7602
                    CVE-2017-9403 CVE-2017-9404
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Software Development Kit 12-SP2
                    SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Server 12-SP2
                    SUSE Linux Enterprise Desktop 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________

   An update that fixes 14 vulnerabilities is now available.

Description:

   This update for tiff to version 4.0.8 fixes a several bugs and security
   issues:

   These security issues were fixed:

   - CVE-2017-7595: The JPEGSetupEncode function allowed remote attackers to
     cause a denial of service (divide-by-zero error and application crash)
     via a crafted image (bsc#1033127).
   - CVE-2016-10371: The TIFFWriteDirectoryTagCheckedRational function
     allowed remote attackers to cause a denial of service (assertion failure
     and application exit) via a crafted TIFF file (bsc#1038438).
   - CVE-2017-7598: Error in tif_dirread.c allowed remote attackers to cause
     a denial of service (divide-by-zero error and application crash) via a
     crafted image (bsc#1033118).
   - CVE-2017-7596: Undefined behavior because of floats outside their
     expected value range, which allowed remote attackers to cause a denial
     of service (application crash) or possibly have unspecified other impact
     via a crafted image (bsc#1033126).
   - CVE-2017-7597: Undefined behavior because of floats outside their
     expected value range, which allowed remote attackers to cause a denial
     of service (application crash) or possibly have unspecified other impact
     via a crafted image (bsc#1033120).
   - CVE-2017-7599: Undefined behavior because of shorts outside their
     expected value range, which allowed remote attackers to cause a denial
     of service (application crash) or possibly have unspecified other impact
     via a crafted image (bsc#1033113).
   - CVE-2017-7600: Undefined behavior because of chars outside their
     expected value range, which allowed remote attackers to cause a denial
     of service (application crash) or possibly have unspecified other impact
     via a crafted image (bsc#1033112).
   - CVE-2017-7601: Because of a shift exponent too large for 64-bit type
     long undefined behavior was caused, which allowed remote attackers to
     cause a denial of service (application crash) or possibly have
     unspecified other impact via a crafted image (bsc#1033111).
   - CVE-2017-7602: Prevent signed integer overflow, which allowed remote
     attackers to cause a denial of service (application crash) or possibly
     have unspecified other impact via a crafted image (bsc#1033109).
   - CVE-2017-7592: The putagreytile function had a left-shift undefined
     behavior issue, which might allowed remote attackers to cause a denial
     of service (application crash) or possibly have unspecified other impact
     via a crafted image (bsc#1033131).
   - CVE-2017-7593: Ensure that tif_rawdata is properly initialized, to
     prevent remote attackers to obtain sensitive information from process
     memory via a crafted image (bsc#1033129).
   - CVE-2017-7594: The OJPEGReadHeaderInfoSecTablesDcTable function allowed
     remote attackers to cause a denial of service (memory leak) via a
     crafted image (bsc#1033128).
   - CVE-2017-9403: Prevent memory leak in function
     TIFFReadDirEntryLong8Array, which allowed attackers to cause a denial of
     service via a crafted file (bsc#1042805).
   - CVE-2017-9404: Fixed memory leak vulnerability in function
     OJPEGReadHeaderInfoSecTablesQTable, which allowed attackers to cause a
     denial of service via a crafted file (bsc#1042804).

   These various other issues were fixed:

   - Fix uint32 overflow in TIFFReadEncodedStrip() that caused an integer
     division by zero. Reported by Agostino Sarubbo.
   - fix heap-based buffer overflow on generation of PixarLog / LUV
     compressed files, with ColorMap, TransferFunction attached and nasty
     plays with bitspersample. The fix for LUV has not been tested, but
     suffers from the same kind of issue of PixarLog.
   - modify ChopUpSingleUncompressedStrip() to instanciate compute ntrips as
     TIFFhowmany_32(td->td_imagelength, rowsperstrip), instead of a logic
     based on the total size of data. Which is faulty is the total size of
     data is not sufficient to fill the whole image, and thus results in
     reading outside of the StripByCounts/StripOffsets arrays when using
     TIFFReadScanline()
   - make OJPEGDecode() early exit in case of failure in OJPEGPreDecode().
     This will avoid a divide by zero, and potential other issues.
   - fix misleading indentation as warned by GCC.
   - revert change done on 2016-01-09 that made Param member of TIFFFaxTabEnt
     structure a uint16 to reduce size of the binary. It happens that the
     Hylafax software uses the tables that follow this typedef
     (TIFFFaxMainTable, TIFFFaxWhiteTable, TIFFFaxBlackTable), although they
     are not in a public libtiff header.
   - add TIFFReadRGBAStripExt() and TIFFReadRGBATileExt() variants
     of the functions without ext, with an extra argument to control the
      stop_on_error behaviour.
   - fix potential memory leaks in error code path of TIFFRGBAImageBegin().
   - increase libjpeg max memory usable to 10 MB instead of libjpeg 1MB
     default. This helps when creating files with "big" tile, without using
     libjpeg temporary files.
   - add _TIFFcalloc()
   - return 0 in Encode functions instead of -1 when TIFFFlushData1() fails.
   - only run JPEGFixupTagsSubsampling() if the YCbCrSubsampling tag is not
     explicitly present. This helps a bit to reduce the I/O amount when the
     tag is present (especially on cloud hosted files).
   - in LZWPostEncode(), increase, if necessary, the code bit-width after
     flushing the remaining code and before emitting the EOI code.
   - fix memory leak in error code path of PixarLogSetupDecode().
   - fix potential memory leak in OJPEGReadHeaderInfoSecTablesQTable,
     OJPEGReadHeaderInfoSecTablesDcTable and
     OJPEGReadHeaderInfoSecTablesAcTable
   - avoid crash in Fax3Close() on empty file.
   - TIFFFillStrip(): add limitation to the number of bytes read in case
     td_stripbytecount[strip] is bigger than reasonable, so as to avoid
     excessive memory allocation.
   - fix memory leak when the underlying codec (ZIP, PixarLog) succeeds its
     setupdecode() method, but PredictorSetup fails.
   - TIFFFillStrip() and TIFFFillTile(): avoid excessive memory allocation in
     case of shorten files. Only effective on 64 bit builds and non-mapped
     cases.
   - TIFFFillStripPartial() / TIFFSeek(), avoid potential integer
     overflows with read_ahead in CHUNKY_STRIP_READ_SUPPORT mode.
   - avoid excessive memory allocation in case of shorten files. Only
     effective on 64 bit builds.
   - update tif_rawcc in CHUNKY_STRIP_READ_SUPPORT mode with
     tif_rawdataloaded when calling TIFFStartStrip() or
     TIFFFillStripPartial().
   - avoid potential int32 overflow in TIFFYCbCrToRGBInit() Fixes
   - avoid potential int32 overflows in multiply_ms() and add_ms().
   - fix out-of-buffer read in PackBitsDecode() Fixes
   - LogL16InitState(): avoid excessive memory allocation when RowsPerStrip
     tag is missing.
   - update dec_bitsleft at beginning of LZWDecode(), and update tif_rawcc at
     end of LZWDecode(). This is needed to properly work with the latest
     chnges in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.
   - PixarLogDecode(): resync tif_rawcp with next_in and tif_rawcc with
     avail_in at beginning and end of function, similarly to what is done in
     LZWDecode(). Likely needed so that it works properly with latest chnges
     in tif_read.c in CHUNKY_STRIP_READ_SUPPORT mode.
   - initYCbCrConversion(): add basic validation of luma and refBlackWhite
     coefficients (just check they are not NaN for now), to avoid potential
     float to int overflows.
   - _TIFFVSetField(): fix outside range cast of double to float.
   - initYCbCrConversion(): check luma[1] is not zero to avoid division by
     zero
   - _TIFFVSetField(): fix outside range cast of double to float.
   - initYCbCrConversion(): check luma[1] is not zero to avoid division by
     zero.
   - initYCbCrConversion(): stricter validation for refBlackWhite
     coefficients values.
   - avoid uint32 underflow in cpDecodedStrips that can cause various issues,
     such as buffer overflows in the library.
   - fix readContigStripsIntoBuffer() in -i (ignore) mode so that the output
     buffer is correctly incremented to avoid write
     outside bounds.
   - add 3 extra bytes at end of strip buffer in
     readSeparateStripsIntoBuffer() to avoid read outside of heap allocated
     buffer.
   - fix integer division by zero when BitsPerSample is missing.
   - fix null pointer dereference in -r mode when the image has no
     StripByteCount tag.
   - avoid potential division by zero is BitsPerSamples tag is missing.
   - when TIFFGetField(, TIFFTAG_NUMBEROFINKS, ) is called, limit the return
     number of inks to SamplesPerPixel, so that code that parses ink names
     doesn't go past the end of the buffer.
   - avoid potential division by zero is BitsPerSamples tag is missing.
   - fix uint32 underflow/overflow that can cause heap-based buffer
     overflow.
   - replace assert( (bps % 8) == 0 ) by a non assert check.
   - fix 2 heap-based buffer overflows (in PSDataBW and PSDataColorContig).
   - prevent heap-based buffer overflow in -j mode on a paletted image.
   - fix wrong usage of memcpy() that can trigger unspecified behaviour.
   - avoid potential invalid memory read in t2p_writeproc.
   - avoid potential heap-based overflow in t2p_readwrite_pdf_image_tile().
   - remove extraneous TIFFClose() in error code path, that caused double
     free.
   - error out cleanly in cpContig2SeparateByRow and cpSeparate2ContigByRow
     if BitsPerSample != 8 to avoid heap based overflow.
   - avoid integer division by zero.
   - call TIFFClose() in error code paths.
   - emit appropriate message if the input file is empty.
   - close TIFF handle in error code path.


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1589=1

   - SUSE Linux Enterprise Software Development Kit 12-SP2:

      zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1589=1

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:

      zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1589=1

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1589=1

   - SUSE Linux Enterprise Server 12-SP2:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1589=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1589=1

   - SUSE Linux Enterprise Desktop 12-SP2:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1589=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

      libtiff-devel-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64):

      libtiff-devel-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):

      libtiff5-4.0.8-44.3.1
      libtiff5-debuginfo-4.0.8-44.3.1
      tiff-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      libtiff5-4.0.8-44.3.1
      libtiff5-debuginfo-4.0.8-44.3.1
      tiff-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64):

      libtiff5-32bit-4.0.8-44.3.1
      libtiff5-debuginfo-32bit-4.0.8-44.3.1

   - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64):

      libtiff5-4.0.8-44.3.1
      libtiff5-debuginfo-4.0.8-44.3.1
      tiff-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64):

      libtiff5-32bit-4.0.8-44.3.1
      libtiff5-debuginfo-32bit-4.0.8-44.3.1

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      libtiff5-32bit-4.0.8-44.3.1
      libtiff5-4.0.8-44.3.1
      libtiff5-debuginfo-32bit-4.0.8-44.3.1
      libtiff5-debuginfo-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1

   - SUSE Linux Enterprise Desktop 12-SP2 (x86_64):

      libtiff5-32bit-4.0.8-44.3.1
      libtiff5-4.0.8-44.3.1
      libtiff5-debuginfo-32bit-4.0.8-44.3.1
      libtiff5-debuginfo-4.0.8-44.3.1
      tiff-debuginfo-4.0.8-44.3.1
      tiff-debugsource-4.0.8-44.3.1


References:

   https://www.suse.com/security/cve/CVE-2016-10371.html
   https://www.suse.com/security/cve/CVE-2017-7592.html
   https://www.suse.com/security/cve/CVE-2017-7593.html
   https://www.suse.com/security/cve/CVE-2017-7594.html
   https://www.suse.com/security/cve/CVE-2017-7595.html
   https://www.suse.com/security/cve/CVE-2017-7596.html
   https://www.suse.com/security/cve/CVE-2017-7597.html
   https://www.suse.com/security/cve/CVE-2017-7598.html
   https://www.suse.com/security/cve/CVE-2017-7599.html
   https://www.suse.com/security/cve/CVE-2017-7600.html
   https://www.suse.com/security/cve/CVE-2017-7601.html
   https://www.suse.com/security/cve/CVE-2017-7602.html
   https://www.suse.com/security/cve/CVE-2017-9403.html
   https://www.suse.com/security/cve/CVE-2017-9404.html
   https://bugzilla.suse.com/1033109
   https://bugzilla.suse.com/1033111
   https://bugzilla.suse.com/1033112
   https://bugzilla.suse.com/1033113
   https://bugzilla.suse.com/1033118
   https://bugzilla.suse.com/1033120
   https://bugzilla.suse.com/1033126
   https://bugzilla.suse.com/1033127
   https://bugzilla.suse.com/1033128
   https://bugzilla.suse.com/1033129
   https://bugzilla.suse.com/1033131
   https://bugzilla.suse.com/1038438
   https://bugzilla.suse.com/1042804
   https://bugzilla.suse.com/1042805



More information about the sle-security-updates mailing list