USN-3606-1: LibTIFF vulnerabilities
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in 4.0.8-5ubuntu0.1 - Upgrade
Upgrade
ubuntu/libtiff5to a version that resolves this vulnerability.Fixed in 4.0.8-5ubuntu0.1 - Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in 4.0.6-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/libtiff5to a version that resolves this vulnerability.Fixed in 4.0.6-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/libtiff-toolsto a version that resolves this vulnerability.Fixed in 4.0.3-7ubuntu0.9 - Upgrade
Upgrade
ubuntu/libtiff5to a version that resolves this vulnerability.Fixed in 4.0.3-7ubuntu0.9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-3606-1?
USN-3606-1 is classified as a high severity vulnerability due to the potential for denial of service and arbitrary code execution.
How do I fix USN-3606-1?
To fix USN-3606-1, upgrade the affected LibTIFF packages to the recommended versions specified in the advisory.
What systems are affected by USN-3606-1?
USN-3606-1 affects Ubuntu versions 14.04, 16.04, and 17.10 with specific LibTIFF package versions.
What type of vulnerability is USN-3606-1?
USN-3606-1 is a memory corruption vulnerability in LibTIFF that can be exploited through specially crafted images.
Can USN-3606-1 lead to remote code execution?
Yes, USN-3606-1 may allow remote attackers to execute arbitrary code if a user opens a malicious image.