Bug 1113094 (CVE-2018-18557)

Summary: VUL-1: CVE-2018-18557: tiff: JBIG decode can lead to out-of-bounds write
Product: [Novell Products] SUSE Security Incidents Reporter: Robert Frohl <rfrohl>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P4 - Low CC: pgajdos, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/217864/
Whiteboard: CVSSv3:SUSE:CVE-2018-18557:4.4:(AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) CVSSv3:RedHat:CVE-2018-18557:5.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) CVSSv2:NVD:CVE-2018-18557:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv3:NVD:CVE-2018-18557:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Robert Frohl 2018-10-24 12:04:07 UTC
CVE-2018-18557
LibTIFF 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.

upstream patch:
https://gitlab.com/libtiff/libtiff/merge_requests/38/diffs?commit_id=681748ec2f5ce88da5f9fa6831e1653e46af8a66#c050e6848d976c17dc98a2f5a63783186dae0848

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18557
http://www.cvedetails.com/cve/CVE-2018-18557/
Comment 1 Robert Frohl 2018-10-24 12:08:48 UTC
Hi Michael, 
after reviewing the codestreams I believe that these are the ones who are affected:
- SUSE:SLE-15:Update/tiff
- SUSE:SLE-12:Update/tiff

likely not affected:
- SUSE:SLE-11:Update/tiff
- SUSE:SLE-10-SP3:Update/tiff
Comment 2 Petr Gajdos 2018-11-12 13:10:25 UTC
Submitted 4.0.10 which fixes this to devel project.
Comment 3 Petr Gajdos 2018-11-12 14:52:47 UTC
Will submit for 15/tiff and 12/tiff.
Comment 4 Petr Gajdos 2018-11-14 14:21:29 UTC
I believe all fixed.
Comment 7 Swamp Workflow Management 2018-11-26 20:11:46 UTC
SUSE-SU-2018:3911-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1099257,1113094,1113672
CVE References: CVE-2018-12900,CVE-2018-18557,CVE-2018-18661
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    tiff-4.0.9-44.27.1
SUSE Linux Enterprise Server 12-SP3 (src):    tiff-4.0.9-44.27.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    tiff-4.0.9-44.27.1
Comment 8 Swamp Workflow Management 2018-11-27 17:11:32 UTC
SUSE-SU-2018:3925-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1099257,1113094,1113672
CVE References: CVE-2018-12900,CVE-2018-18557,CVE-2018-18661
Sources used:
SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src):    tiff-4.0.9-5.17.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    tiff-4.0.9-5.17.1
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    tiff-4.0.9-5.17.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    tiff-4.0.9-5.17.1
Comment 9 Swamp Workflow Management 2018-11-29 23:10:22 UTC
openSUSE-SU-2018:3947-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1099257,1113094,1113672
CVE References: CVE-2018-12900,CVE-2018-18557,CVE-2018-18661
Sources used:
openSUSE Leap 42.3 (src):    tiff-4.0.9-40.1
Comment 10 Swamp Workflow Management 2018-11-29 23:11:15 UTC
openSUSE-SU-2018:3948-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1099257,1113094,1113672
CVE References: CVE-2018-12900,CVE-2018-18557,CVE-2018-18661
Sources used:
openSUSE Leap 15.0 (src):    tiff-4.0.9-lp150.4.9.1
Comment 11 Swamp Workflow Management 2018-12-07 11:22:14 UTC
SUSE-SU-2018:3911-2: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1099257,1113094,1113672
CVE References: CVE-2018-12900,CVE-2018-18557,CVE-2018-18661
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    tiff-4.0.9-44.27.1
SUSE Linux Enterprise Server 12-SP4 (src):    tiff-4.0.9-44.27.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    tiff-4.0.9-44.27.1
Comment 12 Marcus Meissner 2019-01-14 10:30:52 UTC
done