Test Kennung:	1.3.6.1.4.1.25623.1.1.2.2019.2621
Kategorie:	Huawei EulerOS Local Security Checks
Titel:	Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2019-2621)
Zusammenfassung:	The remote host is missing an update for the Huawei EulerOS 'libtiff' package(s) announced via the EulerOS-SA-2019-2621 advisory.
Beschreibung:	Summary: The remote host is missing an update for the Huawei EulerOS 'libtiff' package(s) announced via the EulerOS-SA-2019-2621 advisory. Vulnerability Insight: ** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.(CVE-2017-16232) _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.(CVE-2019-14973) An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.(CVE-2019-7663) An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.(CVE-2018-17101) An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.(CVE-2018-17100) An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c.(CVE-2018-18661) Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (segmentation fault) via a crafted gif file.(CVE-2016-5102) Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.(CVE-2018-12900) In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.(CVE-2018-19210) LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.(CVE-2017-9147) LibTIFF 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.(CVE-2018-18557) Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff.(CVE-2016-5318) The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'libtiff' package(s) on Huawei EulerOS V2.0SP3. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-3623 BugTraq ID: 85952 http://www.securityfocus.com/bid/85952 Debian Security Information: DSA-3762 (Google Search) http://www.debian.org/security/2017/dsa-3762 https://security.gentoo.org/glsa/201701-16 http://www.openwall.com/lists/oss-security/2016/04/08/3 SuSE Security Announcement: openSUSE-SU-2016:2275 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html Common Vulnerability Exposure (CVE) ID: CVE-2016-3624 BugTraq ID: 85956 http://www.securityfocus.com/bid/85956 http://bugzilla.maptools.org/show_bug.cgi?id=2568 http://www.openwall.com/lists/oss-security/2016/04/08/4 Common Vulnerability Exposure (CVE) ID: CVE-2016-5102 BugTraq ID: 96049 http://www.securityfocus.com/bid/96049 https://usn.ubuntu.com/3606-1/ Common Vulnerability Exposure (CVE) ID: CVE-2016-5318 BugTraq ID: 88604 http://www.securityfocus.com/bid/88604 http://www.openwall.com/lists/oss-security/2016/04/27/6 http://www.openwall.com/lists/oss-security/2016/06/07/1 Common Vulnerability Exposure (CVE) ID: CVE-2016-5321 BugTraq ID: 91209 http://www.securityfocus.com/bid/91209 SuSE Security Announcement: openSUSE-SU-2016:3035 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html Common Vulnerability Exposure (CVE) ID: CVE-2016-5323 BugTraq ID: 91196 http://www.securityfocus.com/bid/91196 http://www.openwall.com/lists/oss-security/2016/06/15/6 Common Vulnerability Exposure (CVE) ID: CVE-2017-9147 BugTraq ID: 98594 http://www.securityfocus.com/bid/98594 Debian Security Information: DSA-3903 (Google Search) http://www.debian.org/security/2017/dsa-3903 https://www.exploit-db.com/exploits/42301/ http://bugzilla.maptools.org/show_bug.cgi?id=2693 Common Vulnerability Exposure (CVE) ID: CVE-2019-6128 Bugtraq: 20191104 [slackware-security] libtiff (SSA:2019-308-01) (Google Search) https://seclists.org/bugtraq/2019/Nov/5 https://security.gentoo.org/glsa/202003-25 http://bugzilla.maptools.org/show_bug.cgi?id=2836 http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html SuSE Security Announcement: openSUSE-SU-2019:1161 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html https://usn.ubuntu.com/3906-1/ https://usn.ubuntu.com/3906-2/ Common Vulnerability Exposure (CVE) ID: CVE-2019-7663 Debian Security Information: DSA-4670 (Google Search) https://www.debian.org/security/2020/dsa-4670 http://bugzilla.maptools.org/show_bug.cgi?id=2833 https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.