SUSE-SU-2016:2527-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2016/suse-su-20162527-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:2527-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2016:2527-1
Related
Published
2016-10-13T11:59:37Z
Modified
2016-10-13T11:59:37Z
Summary
Security update for tiff
Details

This update for tiff fixes the following issues:

  • CVE-2016-3622: Specially crafted TIFF images could trigger a crash in tiff2rgba (bsc#974449)
  • Various out-of-bound write vulnerabilities with unspecified impact (MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098)
  • CVE-2016-5314: Specially crafted TIFF images could trigger a crash that could result in DoS (bsc#984831)
  • CVE-2016-5316: Specially crafted TIFF images could trigger a crash in the rgb2ycbcr tool, leading to Doa (bsc#984837)
  • CVE-2016-5317: Specially crafted TIFF images could trigger a crash through an out of bound write (bsc#984842)
  • CVE-2016-5320: Specially crafted TIFF images could trigger a crash or potentially allow remote code execution when using the rgb2ycbcr command (bsc#984808)
  • CVE-2016-5875: Specially crafted TIFF images could trigger could allow arbitrary code execution (bsc#987351)
  • CVE-2016-3623: Specially crafted TIFF images could trigger a crash in rgb2ycbcr (bsc#974618)
  • CVE-2016-3945: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution via tiff2rgba (bsc#974614)
  • CVE-2016-3990: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution (bsc#975069)
  • CVE-2016-3186: Specially crafted TIFF imaged could trigger a crash in the gif2tiff command via a buffer overflow (bsc#973340)
References

Affected packages

SUSE:Linux Enterprise Software Development Kit 11 SP4 / tiff

Package

Name
tiff
Purl
purl:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.2-141.168.1

Ecosystem specific 

{
    "binaries": [
        {
            "libtiff-devel-32bit": "3.8.2-141.168.1",
            "libtiff-devel": "3.8.2-141.168.1"
        }
    ]
}

SUSE:Linux Enterprise Server 11 SP4 / tiff

Package

Name
tiff
Purl
purl:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.2-141.168.1

Ecosystem specific 

{
    "binaries": [
        {
            "tiff": "3.8.2-141.168.1",
            "libtiff3-32bit": "3.8.2-141.168.1",
            "libtiff3": "3.8.2-141.168.1",
            "libtiff3-x86": "3.8.2-141.168.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 11 SP4 / tiff

Package

Name
tiff
Purl
purl:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.2-141.168.1

Ecosystem specific 

{
    "binaries": [
        {
            "tiff": "3.8.2-141.168.1",
            "libtiff3-32bit": "3.8.2-141.168.1",
            "libtiff3": "3.8.2-141.168.1",
            "libtiff3-x86": "3.8.2-141.168.1"
        }
    ]
}