Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | tiff security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-3762 | First vendor Publication | 2017-01-13 |
| Vendor | Debian | Last vendor Modification | 2017-01-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities have been discovered in the libtiff library and the included tools tiff2rgba, rgb2ycbcr, tiffcp, tiffcrop, tiff2pdf and tiffsplit, which may result in denial of service, memory disclosure or the execution of arbitrary code. There were additional vulnerabilities in the tools bmp2tiff, gif2tiff, thumbnail and ras2tiff, but since these were addressed by the libtiff developers by removing the tools altogether, no patches are available and those tools were also removed from the tiff package in Debian stable. The change had already been made in Debian stretch before and no applications included in Debian are known to rely on these scripts. If you use those tools in custom setups, consider using a different conversion/thumbnailing tool. For the stable distribution (jessie), these problems have been fixed in version 4.0.3-12.3+deb8u2. For the testing distribution (stretch), these problems have been fixed in version 4.0.7-4. For the unstable distribution (sid), these problems have been fixed in version 4.0.7-4. We recommend that you upgrade your tiff packages. |
Original Source
| Url : http://www.debian.org/security/2017/dsa-3762 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 34 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 26 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
| 16 % | CWE-125 | Out-of-bounds Read |
| 8 % | CWE-369 | Divide By Zero |
| 8 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
| 5 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 3 % | CWE-476 | NULL Pointer Dereference |
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2016-10-25 | LibTIFF PixarLogDecode heap buffer overflow attempt RuleID : 40540 - Revision : 4 - Type : FILE-IMAGE |
| 2016-10-25 | LibTIFF PixarLogDecode heap buffer overflow attempt RuleID : 40539 - Revision : 4 - Type : FILE-IMAGE |
| 2016-10-25 | LibTIFF tiff2pdf JPEG compression tables heap buffer overflow attempt RuleID : 40526 - Revision : 3 - Type : FILE-IMAGE |
| 2016-10-25 | LibTIFF tiff2pdf JPEG compression tables heap buffer overflow attempt RuleID : 40525 - Revision : 3 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39632 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39631 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39630 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39629 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39628 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39627 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39626 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39625 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39624 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39623 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39622 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39621 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39620 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39619 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39618 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39617 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39616 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39615 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39614 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39613 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39612 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39611 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39610 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39609 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39608 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39607 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39606 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39605 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39604 - Revision : 6 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39603 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39602 - Revision : 5 - Type : FILE-IMAGE |
| 2016-07-17 | Multiple products TIFF tile size buffer overflow attempt RuleID : 39601 - Revision : 5 - Type : FILE-IMAGE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2019-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2018-cc86e5bc77.nasl - Type : ACT_GATHER_INFO |
| 2018-06-28 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1165.nasl - Type : ACT_GATHER_INFO |
| 2018-05-02 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1103.nasl - Type : ACT_GATHER_INFO |
| 2018-05-02 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1102.nasl - Type : ACT_GATHER_INFO |
| 2017-12-21 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL34527393.nasl - Type : ACT_GATHER_INFO |
| 2017-08-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3212-4.nasl - Type : ACT_GATHER_INFO |
| 2017-07-20 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3212-3.nasl - Type : ACT_GATHER_INFO |
| 2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0225.nasl - Type : ACT_GATHER_INFO |
| 2017-05-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3844.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1034.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1019.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1020.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1043.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1044.nasl - Type : ACT_GATHER_INFO |
| 2017-04-10 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2017-098-01.nasl - Type : ACT_GATHER_INFO |
| 2017-03-31 | Name : The remote host is missing a macOS update that fixes multiple security vulner... File : macos_10_12_4.nasl - Type : ACT_GATHER_INFO |
| 2017-03-31 | Name : The remote Debian host is missing a security update. File : debian_DLA-880.nasl - Type : ACT_GATHER_INFO |
| 2017-03-07 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-802.nasl - Type : ACT_GATHER_INFO |
| 2017-02-28 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3212-1.nasl - Type : ACT_GATHER_INFO |
| 2017-02-07 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_fb74eaccec8a11e6bc8a0011d823eebd.nasl - Type : ACT_GATHER_INFO |
| 2017-02-03 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170201_libtiff_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2017-02-02 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0225.nasl - Type : ACT_GATHER_INFO |
| 2017-02-02 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2017-0037.nasl - Type : ACT_GATHER_INFO |
| 2017-02-02 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2017-0036.nasl - Type : ACT_GATHER_INFO |
| 2017-02-02 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0225.nasl - Type : ACT_GATHER_INFO |
| 2017-02-02 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0225.nasl - Type : ACT_GATHER_INFO |
| 2017-01-24 | Name : The remote Debian host is missing a security update. File : debian_DLA-795.nasl - Type : ACT_GATHER_INFO |
| 2017-01-16 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3762.nasl - Type : ACT_GATHER_INFO |
| 2017-01-10 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-53.nasl - Type : ACT_GATHER_INFO |
| 2017-01-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-16.nasl - Type : ACT_GATHER_INFO |
| 2017-01-03 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-3301-1.nasl - Type : ACT_GATHER_INFO |
| 2016-12-08 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1425.nasl - Type : ACT_GATHER_INFO |
| 2016-11-23 | Name : The remote Debian host is missing a security update. File : debian_DLA-716.nasl - Type : ACT_GATHER_INFO |
| 2016-11-09 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL89096577.nasl - Type : ACT_GATHER_INFO |
| 2016-11-03 | Name : The remote Debian host is missing a security update. File : debian_DLA-693.nasl - Type : ACT_GATHER_INFO |
| 2016-10-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1196.nasl - Type : ACT_GATHER_INFO |
| 2016-10-14 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2527-1.nasl - Type : ACT_GATHER_INFO |
| 2016-10-14 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1187.nasl - Type : ACT_GATHER_INFO |
| 2016-10-14 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1186.nasl - Type : ACT_GATHER_INFO |
| 2016-10-13 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2508-1.nasl - Type : ACT_GATHER_INFO |
| 2016-09-26 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1122.nasl - Type : ACT_GATHER_INFO |
| 2016-09-19 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1089.nasl - Type : ACT_GATHER_INFO |
| 2016-09-12 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2271-1.nasl - Type : ACT_GATHER_INFO |
| 2016-09-06 | Name : The remote Debian host is missing a security update. File : debian_DLA-610.nasl - Type : ACT_GATHER_INFO |
| 2016-08-31 | Name : The remote Debian host is missing a security update. File : debian_DLA-606.nasl - Type : ACT_GATHER_INFO |
| 2016-08-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-734.nasl - Type : ACT_GATHER_INFO |
| 2016-08-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-733.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1547.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1546.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0093.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-1547.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-1546.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-1547.nasl - Type : ACT_GATHER_INFO |
| 2016-08-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-1546.nasl - Type : ACT_GATHER_INFO |
| 2016-07-28 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-911.nasl - Type : ACT_GATHER_INFO |
| 2016-07-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_0ab660884aa511e6a7bd14dae9d210b8.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2018-03-13 09:21:14 |
|
| 2017-04-12 00:26:44 |
|
| 2017-03-07 21:23:57 |
|
| 2017-02-06 21:25:20 |
|
| 2017-01-27 21:25:33 |
|
| 2017-01-17 13:22:45 |
|
| 2017-01-13 17:24:55 |
|
