glsa-201701-16.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201701-16">
  <title>libTIFF: Multiple vulnerabilities</title>
  <synopsis>Multiple vulnerabilities have been found in libTIFF, the worst of
    which may allow execution of arbitrary code.
  </synopsis>
  <product type="ebuild">tiff</product>
  <announced>2017-01-09</announced>
  <revised count="2">2017-01-09</revised>
  <bug>484542</bug>
  <bug>534108</bug>
  <bug>538318</bug>
  <bug>561880</bug>
  <bug>572876</bug>
  <bug>585274</bug>
  <bug>585508</bug>
  <bug>599746</bug>
  <access>remote</access>
  <affected>
    <package name="media-libs/tiff" auto="yes" arch="*">
      <unaffected range="ge">4.0.7</unaffected>
      <vulnerable range="lt">4.0.7</vulnerable>
    </package>
  </affected>
  <background>
    <p>The TIFF library contains encoding and decoding routines for the Tag
      Image File Format. It is called by numerous programs, including GNOME and
      KDE applications, to interpret TIFF images.
    </p>
  </background>
  <description>
    <p>Multiple vulnerabilities have been discovered in libTIFF. Please review
      the CVE identifier and bug reports referenced for details.
    </p>
  </description>
  <impact type="normal">
    <p>A remote attacker could entice a user to process a specially crafted
      image file, possibly resulting in execution of arbitrary code with the
      privileges of the process or a Denial of Service condition.
    </p>
  </impact>
  <workaround>
    <p>There is no known workaround at this time.</p>
  </workaround>
  <resolution>
    <p>All libTIFF users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=media-libs/tiff-4.0.7"
    </code>
  </resolution>
  <references>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4243">CVE-2013-4243</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8127">CVE-2014-8127</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8128">CVE-2014-8128</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8129">CVE-2014-8129</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8130">CVE-2014-8130</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9330">CVE-2014-9330</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9655">CVE-2014-9655</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1547">CVE-2015-1547</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7313">CVE-2015-7313</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7554">CVE-2015-7554</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8665">CVE-2015-8665</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8668">CVE-2015-8668</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8683">CVE-2015-8683</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8781">CVE-2015-8781</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8782">CVE-2015-8782</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8783">CVE-2015-8783</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8784">CVE-2015-8784</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3186">CVE-2016-3186</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3619">CVE-2016-3619</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3620">CVE-2016-3620</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3621">CVE-2016-3621</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3622">CVE-2016-3622</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3623">CVE-2016-3623</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3624">CVE-2016-3624</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3625">CVE-2016-3625</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3631">CVE-2016-3631</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3632">CVE-2016-3632</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3633">CVE-2016-3633</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3634">CVE-2016-3634</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3658">CVE-2016-3658</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3945">CVE-2016-3945</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3990">CVE-2016-3990</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3991">CVE-2016-3991</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5102">CVE-2016-5102</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5314">CVE-2016-5314</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5315">CVE-2016-5315</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5316">CVE-2016-5316</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5317">CVE-2016-5317</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5318">CVE-2016-5318</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5319">CVE-2016-5319</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5320">CVE-2016-5320</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5321">CVE-2016-5321</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5322">CVE-2016-5322</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5323">CVE-2016-5323</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5652">CVE-2016-5652</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5875">CVE-2016-5875</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6223">CVE-2016-6223</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8331">CVE-2016-8331</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9273">CVE-2016-9273</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9297">CVE-2016-9297</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9448">CVE-2016-9448</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9453">CVE-2016-9453</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9532">CVE-2016-9532</uri>
  </references>
  <metadata tag="requester" timestamp="2016-07-11T05:00:13Z">b-man</metadata>
  <metadata tag="submitter" timestamp="2017-01-09T20:05:48Z">b-man</metadata>
</glsa>