SUSE-SU-2018:1889-1: moderate: Security update for tiff

sle-security-updates at sle-security-updates at
Thu Jul 5 04:16:43 MDT 2018

   SUSE Security Update: Security update for tiff

Announcement ID:    SUSE-SU-2018:1889-1
Rating:             moderate
References:         #1074317 #1082332 #1082825 #1086408 #1092949 
Cross-References:   CVE-2017-11613 CVE-2017-18013 CVE-2018-10963
                    CVE-2018-7456 CVE-2018-8905
Affected Products:
                    SUSE Linux Enterprise Module for Desktop Applications 15
                    SUSE Linux Enterprise Module for Basesystem 15

   An update that fixes 5 vulnerabilities is now available.


   This update for tiff fixes the following security issues:

   These security issues were fixed:

   - CVE-2017-18013: Fixed a NULL pointer dereference in the
     tif_print.cTIFFPrintDirectory function that could have lead to denial of
     service (bsc#1074317).
   - CVE-2018-10963: Fixed an assertion failure in the
     TIFFWriteDirectorySec() function in tif_dirwrite.c, which allowed remote
     attackers to cause a denial
     of service via a crafted file (bsc#1092949).
   - CVE-2018-7456: Prevent a NULL Pointer dereference in the function
     TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF
     information, a different vulnerability than CVE-2017-18013 (bsc#1082825).
   - CVE-2017-11613: Prevent denial of service in the TIFFOpen function.
     During the TIFFOpen process, td_imagelength is not checked. The value of
     td_imagelength can be directly controlled by an input file. In the
     ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is
     called based on td_imagelength. If the value of td_imagelength is set
     close to the amount of system memory, it will hang the system or trigger
     the OOM killer (bsc#1082332).
   - CVE-2018-8905: Prevent heap-based buffer overflow in the function
     LZWDecodeCompat via a crafted TIFF file (bsc#1086408).

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Desktop Applications 15:

      zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-1279=1

   - SUSE Linux Enterprise Module for Basesystem 15:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-1279=1

Package List:

   - SUSE Linux Enterprise Module for Desktop Applications 15 (x86_64):


   - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64):



More information about the sle-security-updates mailing list