First published: Tue Mar 12 2019(Updated: )
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
Affected Software | Affected Version | How to fix |
---|---|---|
All of | ||
ubuntu/libtiff-tools | <4.0.9-6ubuntu0.2 | 4.0.9-6ubuntu0.2 |
Ubuntu OpenSSH Client | =18.10 | |
All of | ||
ubuntu/libtiff5 | <4.0.9-6ubuntu0.2 | 4.0.9-6ubuntu0.2 |
Ubuntu OpenSSH Client | =18.10 | |
All of | ||
ubuntu/libtiff-tools | <4.0.9-5ubuntu0.2 | 4.0.9-5ubuntu0.2 |
Ubuntu OpenSSH Client | =18.04 | |
All of | ||
ubuntu/libtiff5 | <4.0.9-5ubuntu0.2 | 4.0.9-5ubuntu0.2 |
Ubuntu OpenSSH Client | =18.04 | |
All of | ||
ubuntu/libtiff-tools | <4.0.6-1ubuntu0.6 | 4.0.6-1ubuntu0.6 |
Ubuntu OpenSSH Client | =16.04 | |
All of | ||
ubuntu/libtiff5 | <4.0.6-1ubuntu0.6 | 4.0.6-1ubuntu0.6 |
Ubuntu OpenSSH Client | =16.04 | |
All of | ||
ubuntu/libtiff-tools | <4.0.3-7ubuntu0.11 | 4.0.3-7ubuntu0.11 |
Ubuntu OpenSSH Client | =14.04 | |
All of | ||
ubuntu/libtiff5 | <4.0.3-7ubuntu0.11 | 4.0.3-7ubuntu0.11 |
Ubuntu OpenSSH Client | =14.04 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Contains the following vulnerabilities)
USN-3906-1 is classified as a high-severity vulnerability that can lead to denial of service or arbitrary code execution.
To fix USN-3906-1, upgrade the affected packages to the recommended versions specified in the Ubuntu security notice.
USN-3906-1 affects various versions of Ubuntu, specifically 14.04, 16.04, 18.04, and 18.10 with specific versions of libtiff-tools and libtiff5.
USN-3906-1 involves vulnerabilities due to improper handling of malformed images in the LibTIFF library.
Yes, USN-3906-1 can be exploited remotely if a user is tricked into opening a specially crafted image.