Debian Security Advisory
DLA-2009-1 tiff -- LTS security update
- Date Reported:
- 26 Nov 2019
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-17095, CVE-2018-12900, CVE-2018-18661, CVE-2019-6128, CVE-2019-17546, CVE-2017-17095.
- More information:
Several issues have been found in tiff, a Tag Image File Format library.
The RGBA interface contains an integer overflow that might lead to heap buffer overflow write.
A memory leak exists due to missing cleanup code.
In case of exhausted memory there is a null pointer dereference in tiff2bw.
Fix for heap-based buffer overflow, that could be used to crash an application or even to execute arbitrary code (with the permission of the user running this application).
A crafted tiff file could lead to a heap buffer overflow in pal2rgb.
For Debian 8
Jessie, these problems have been fixed in version 4.0.3-12.3+deb8u10.
We recommend that you upgrade your tiff packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS