Test ID:	1.3.6.1.4.1.25623.1.1.4.2013.1639.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2013:1639-1)
Summary:	The remote host is missing an update for the 'libtiff' package(s) announced via the SUSE-SU-2013:1639-1 advisory.
Description:	Summary: The remote host is missing an update for the 'libtiff' package(s) announced via the SUSE-SU-2013:1639-1 advisory. Vulnerability Insight: This tiff LTSS roll up update fixes several security issues. * CVE-2013-4232 CVE-2013-4231: buffer overflows/use after free problem * CVE-2013-4243: libtiff (gif2tiff): heap-based buffer overflow in readgifimage() * CVE-2013-4244: libtiff (gif2tiff): OOB Write in LZW decompressor * CVE-2013-1961: Stack-based buffer overflow with malformed image-length and resolution * CVE-2013-1960: Heap-based buffer overflow in t2_process_jpeg_strip() * CVE-2012-4447: Heap-buffer overflow when processing a TIFF image with PixarLog Compression * CVE-2012-4564: Added a ppm2tiff missing return value check * CVE-2012-5581: Fixed Stack based buffer overflow when handling DOTRANGE tags * CVE-2012-3401: Fixed Heap-based buffer overflow due to improper initialization of T2P context struct pointer * CVE-2012-2113: integer overflow leading to heap-based buffer overflow when parsing crafted tiff files * Another heap-based memory corruption in the tiffp2s commandline tool has been fixed [bnc#788741] * CVE-2012-2088: A type conversion flaw in libtiff has been fixed. * CVE-2012-1173: A heap based buffer overflow in TIFFReadRGBAImageOriented was fixed. Security Issue references: * CVE-2012-1173 > * CVE-2012-2088 > * CVE-2012-2113 > * CVE-2012-3401 > * CVE-2012-4447 > * CVE-2012-4564 > * CVE-2012-5581 > * CVE-2013-1960 > * CVE-2013-1961 > * CVE-2013-4231 > * CVE-2013-4232 > * CVE-2013-4243 > * CVE-2013-4244 > Affected Software/OS: 'libtiff' package(s) on SUSE Linux Enterprise Server 10-SP3. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1173 1026895 http://www.securitytracker.com/id?1026895 48684 http://secunia.com/advisories/48684 48722 http://secunia.com/advisories/48722 48735 http://secunia.com/advisories/48735 48757 http://secunia.com/advisories/48757 48893 http://secunia.com/advisories/48893 50726 http://secunia.com/advisories/50726 52891 http://www.securityfocus.com/bid/52891 81025 http://www.osvdb.org/81025 APPLE-SA-2012-09-19-1 http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html APPLE-SA-2012-09-19-2 http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html DSA-2447 http://www.debian.org/security/2012/dsa-2447 FEDORA-2012-5406 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078403.html FEDORA-2012-5410 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078835.html FEDORA-2012-5463 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077463.html GLSA-201209-02 http://security.gentoo.org/glsa/glsa-201209-02.xml MDVSA-2012:054 http://www.mandriva.com/security/advisories?name=MDVSA-2012:054 RHSA-2012:0468 http://rhn.redhat.com/errata/RHSA-2012-0468.html USN-1416-1 http://ubuntu.com/usn/usn-1416-1 http://bugzilla.maptools.org/attachment.cgi?id=477&action=diff http://bugzilla.maptools.org/show_bug.cgi?id=2369 http://home.gdal.org/private/zdi-can-1221/zdi-can-1221.txt http://support.apple.com/kb/HT5501 http://support.apple.com/kb/HT5503 https://downloads.avaya.com/css/P8/documents/100161772 libtiff-gttileseparate-bo(74656) https://exchange.xforce.ibmcloud.com/vulnerabilities/74656 openSUSE-SU-2012:0539 https://hermes.opensuse.org/messages/14302713 Common Vulnerability Exposure (CVE) ID: CVE-2012-2088 49686 http://secunia.com/advisories/49686 54270 http://www.securityfocus.com/bid/54270 APPLE-SA-2013-03-14-1 http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html MDVSA-2012:101 http://www.mandriva.com/security/advisories?name=MDVSA-2012:101 RHSA-2012:1054 http://rhn.redhat.com/errata/RHSA-2012-1054.html SUSE-SU-2012:0894 http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00010.html http://support.apple.com/kb/HT6162 http://support.apple.com/kb/HT6163 https://bugzilla.redhat.com/show_bug.cgi?id=832864 openSUSE-SU-2012:0829 https://hermes.opensuse.org/messages/15083566 Common Vulnerability Exposure (CVE) ID: CVE-2012-2113 49493 http://secunia.com/advisories/49493 54076 http://www.securityfocus.com/bid/54076 DSA-2552 http://www.debian.org/security/2012/dsa-2552 http://www.remotesensing.org/libtiff/v4.0.2.html https://bugzilla.redhat.com/show_bug.cgi?id=810551 Common Vulnerability Exposure (CVE) ID: CVE-2012-3401 49938 http://secunia.com/advisories/49938 50007 http://secunia.com/advisories/50007 54601 http://www.securityfocus.com/bid/54601 84090 http://osvdb.org/84090 MDVSA-2012:127 http://www.mandriva.com/security/advisories?name=MDVSA-2012:127 RHSA-2012:1590 http://rhn.redhat.com/errata/RHSA-2012-1590.html USN-1511-1 http://www.ubuntu.com/usn/USN-1511-1 [oss-security] 20120719 Re: tiff2pdf: Heap-based buffer overflow due to improper initialization of T2P context struct pointer http://www.openwall.com/lists/oss-security/2012/07/19/4 [oss-security] 20120719 tiff2pdf: Heap-based buffer overflow due to improper initialization of T2P context struct pointer http://www.openwall.com/lists/oss-security/2012/07/19/1 http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf https://bugzilla.redhat.com/attachment.cgi?id=596457 https://bugzilla.redhat.com/show_bug.cgi?id=837577 libtiff-t2preadtiffinit-bo(77088) https://exchange.xforce.ibmcloud.com/vulnerabilities/77088 openSUSE-SU-2012:0955 http://lists.opensuse.org/opensuse-updates/2012-08/msg00011.html Common Vulnerability Exposure (CVE) ID: CVE-2012-4447 51049 http://secunia.com/advisories/51049 55673 http://www.securityfocus.com/bid/55673 DSA-2561 http://www.debian.org/security/2012/dsa-2561 USN-1631-1 http://www.ubuntu.com/usn/USN-1631-1 [oss-security] 20120925 CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression http://www.openwall.com/lists/oss-security/2012/09/25/9 [oss-security] 20120925 Re: CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression http://www.openwall.com/lists/oss-security/2012/09/25/14 http://www.remotesensing.org/libtiff/v4.0.3.html https://bugzilla.redhat.com/show_bug.cgi?id=860198 openSUSE-SU-2013:0187 http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html Common Vulnerability Exposure (CVE) ID: CVE-2012-4564 51133 http://secunia.com/advisories/51133 56372 http://www.securityfocus.com/bid/56372 86878 http://www.osvdb.org/86878 DSA-2575 http://www.debian.org/security/2012/dsa-2575 [oss-security] 20121102 Re: libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file http://www.openwall.com/lists/oss-security/2012/11/02/7 [oss-security] 20121102 libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file http://www.openwall.com/lists/oss-security/2012/11/02/3 https://bugzilla.redhat.com/show_bug.cgi?id=871700 libtiff-ppm2tiff-bo(79750) https://exchange.xforce.ibmcloud.com/vulnerabilities/79750 Common Vulnerability Exposure (CVE) ID: CVE-2012-5581 51491 http://secunia.com/advisories/51491 56715 http://www.securityfocus.com/bid/56715 DSA-2589 http://www.debian.org/security/2012/dsa-2589 USN-1655-1 http://www.ubuntu.com/usn/USN-1655-1 [oss-security] 20121128 libtiff: Stack based buffer overflow when handling DOTRANGE tags http://www.openwall.com/lists/oss-security/2012/11/28/1 https://bugzilla.redhat.com/show_bug.cgi?id=867235 libtiff-dotrange-bo(80339) https://exchange.xforce.ibmcloud.com/vulnerabilities/80339 Common Vulnerability Exposure (CVE) ID: CVE-2013-1960 53237 http://secunia.com/advisories/53237 53765 http://secunia.com/advisories/53765 59609 http://www.securityfocus.com/bid/59609 DSA-2698 http://www.debian.org/security/2013/dsa-2698 FEDORA-2013-7339 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104916.html FEDORA-2013-7361 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105828.html FEDORA-2013-7369 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105253.html RHSA-2014:0223 http://rhn.redhat.com/errata/RHSA-2014-0223.html [oss-security] 20130502 Fwd: Two libtiff (tiff2pdf flaws) http://seclists.org/oss-sec/2013/q2/254 https://bugzilla.redhat.com/show_bug.cgi?id=952158 openSUSE-SU-2013:0922 http://lists.opensuse.org/opensuse-updates/2013-06/msg00058.html openSUSE-SU-2013:0944 http://lists.opensuse.org/opensuse-updates/2013-06/msg00080.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1961 59607 http://www.securityfocus.com/bid/59607 https://bugzilla.redhat.com/show_bug.cgi?id=952131 Common Vulnerability Exposure (CVE) ID: CVE-2013-4231 54543 http://secunia.com/advisories/54543 54628 http://secunia.com/advisories/54628 61695 http://www.securityfocus.com/bid/61695 DSA-2744 http://www.debian.org/security/2013/dsa-2744 [oss-security] 20130809 Re: CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro http://www.openwall.com/lists/oss-security/2013/08/10/2 [tiff] 20130801 Vulnerabilities in libtiff 4.0.3 http://www.asmail.be/msg0055359936.html http://bugzilla.maptools.org/show_bug.cgi?id=2450 https://bugzilla.redhat.com/show_bug.cgi?id=995965 Common Vulnerability Exposure (CVE) ID: CVE-2013-4232 http://bugzilla.maptools.org/show_bug.cgi?id=2449 https://bugzilla.redhat.com/show_bug.cgi?id=995975 Common Vulnerability Exposure (CVE) ID: CVE-2013-4243 62082 http://www.securityfocus.com/bid/62082 GLSA-201701-16 https://security.gentoo.org/glsa/201701-16 http://bugzilla.maptools.org/show_bug.cgi?id=2451 https://bugzilla.redhat.com/show_bug.cgi?id=996052 Common Vulnerability Exposure (CVE) ID: CVE-2013-4244 http://bugzilla.maptools.org/show_bug.cgi?id=2452 https://bugzilla.redhat.com/show_bug.cgi?id=996468 https://github.com/vadz/libtiff/commit/ce6841d9e41d621ba23cf18b190ee6a23b2cc833
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.