From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 9DF1F1396D0 for ; Tue, 26 Sep 2017 22:12:23 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9DC7D2BC028; Tue, 26 Sep 2017 22:11:39 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 2F8982BC008 for ; Tue, 26 Sep 2017 22:11:21 +0000 (UTC) Received: from localhost.localdomain (pool-108-48-108-145.washdc.fios.verizon.net [108.48.108.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: bman) by smtp.gentoo.org (Postfix) with ESMTPSA id 7F7BD33FE49 for ; Tue, 26 Sep 2017 22:11:20 +0000 (UTC) From: Aaron Bauman To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Subject: [gentoo-announce] [ GLSA 201709-27 ] LibTIFF: Multiple vulnerabilities Date: Tue, 26 Sep 2017 18:11:17 -0400 Message-ID: <3559947.cqVStVUssH@localhost.localdomain> Organization: Gentoo Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2042728.y96pJUfbcT"; micalg="pgp-sha256"; protocol="application/pgp-signature" X-Archives-Salt: 1b3fcf4c-8992-4504-b5c4-4cc4f1f361df X-Archives-Hash: 487537af4bfc1785904f55d349df0b3d --nextPart2042728.y96pJUfbcT Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201709-27 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: LibTIFF: Multiple vulnerabilities Date: September 26, 2017 Bugs: #610330, #614020, #614022, #617996, #617998, #618610, #624602 ID: 201709-27 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in the execution of arbitrary code. Background ========== The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-libs/tiff < 4.0.8 >= 4.0.8 Description =========== Multiple vulnerabilities have been discovered in LibTIFF. Please review the referenced CVE identifiers for details. Impact ====== A remote attacker, by enticing the user to process a specially crafted TIFF file, could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or have other unspecified impacts. Workaround ========== There is no known workaround at this time. Resolution ========== All LibTIFF users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.8" Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages. References ========== [ 1 ] CVE-2016-10267 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10267 [ 2 ] CVE-2016-10268 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10268 [ 3 ] CVE-2017-5225 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5225 [ 4 ] CVE-2017-5563 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5563 [ 5 ] CVE-2017-7592 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7592 [ 6 ] CVE-2017-7593 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7593 [ 7 ] CVE-2017-7594 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7594 [ 8 ] CVE-2017-7595 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7595 [ 9 ] CVE-2017-7596 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7596 [ 10 ] CVE-2017-7597 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7597 [ 11 ] CVE-2017-7598 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7598 [ 12 ] CVE-2017-7599 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7599 [ 13 ] CVE-2017-7600 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7600 [ 14 ] CVE-2017-7601 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7601 [ 15 ] CVE-2017-7602 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7602 [ 16 ] CVE-2017-9403 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9403 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-27 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --nextPart2042728.y96pJUfbcT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEiDRK3jyVBE/RkymqpRQw84X1dt0FAlnK0IUACgkQpRQw84X1 dt1WUQf/YYQ1O1pdxuQOPR+JkXSlR0b4Nsoym3iKbihjKtkFZ8UjzDRCbIVvUwmB P3ODCH5vTxWoeWRMpMSG73rEnKubVY6X8VJ2aPJ1SuBqMHnnhLeO5u4LWYQ3r68K CQSOX3Fic+xEFlLI1wzViqbZIgikB2URedH3Bf2aT8COVs5rvIQRx6uagKy3azME DrXzLQQszUyRiU2N4fM+VKG06MIIdZ7wCpAorJ+appecvUnEPAoMHv/k64MS0pth Z+aazzD1xOw4uOL2YLlYig44O94+EKaLyQD8TXCN9G6XPwCrTRBtahltK/oUURFj yq1N+0fJDQbh2AsH+UtBdIr/gm4PLQ== =sy+m -----END PGP SIGNATURE----- --nextPart2042728.y96pJUfbcT--