[ASA-201911-13] libtiff: denial of service

[Remi Gacogne]

Arch Linux Security Advisory ASA-201911-13
==========================================

Severity: Medium
Date    : 2019-11-13
CVE-ID  : CVE-2019-6128 CVE-2019-7663
Package : libtiff
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-886

Summary
=======

The package libtiff before version 4.1.0-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 4.1.0-1.

# pacman -Syu "libtiff>=4.1.0-1"

The problems have been fixed upstream in version 4.1.0.

Workaround
==========

None.

Description
===========

- CVE-2019-6128 (denial of service)

The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory
leak, as demonstrated by pal2rgb.

- CVE-2019-7663 (denial of service)

An Invalid Address dereference was discovered in
TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in
LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in
tiffcp.c. Remote attackers could leverage this vulnerability to cause a
denial-of-service via a crafted tiff file.

Impact
======

A remote attacker is able to cause a denial of service.

References
==========

https://gitlab.com/libtiff/libtiff/commit/ae0bed1fe530a82faf2e9ea1775109dbf301a971
https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39
https://gitlab.com/libtiff/libtiff/merge_requests/60
https://security.archlinux.org/CVE-2019-6128
https://security.archlinux.org/CVE-2019-7663

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20191203/547cb3fd/attachment.sig>