USN-4158-1: LibTIFF vulnerabilities
Published Oct 17, 2019
·Updated
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.
Affected Software
12 affected componentsFixes available
All of the following
ubuntu/libtiff-tools<4.0.10-4ubuntu0.1
4.0.10-4ubuntu0.1
Ubuntu Ubuntu=19.04
All of the following
ubuntu/libtiff5<4.0.10-4ubuntu0.1
4.0.10-4ubuntu0.1
Ubuntu Ubuntu=19.04
All of the following
ubuntu/libtiff-tools<4.0.9-5ubuntu0.3
4.0.9-5ubuntu0.3
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libtiff5<4.0.9-5ubuntu0.3
4.0.9-5ubuntu0.3
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libtiff-tools<4.0.6-1ubuntu0.7
4.0.6-1ubuntu0.7
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libtiff5<4.0.6-1ubuntu0.7
4.0.6-1ubuntu0.7
Ubuntu Ubuntu=16.04
Event History
Oct 17, 2019
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID for this advisory?
USN-4158-1
2
What software is affected by this vulnerability?
LibTIFF
3
What is the severity of USN-4158-1?
High
4
How can a remote attacker exploit this vulnerability?
By tricking a user or automated system into opening a specially crafted image.
5
What is the recommended remedy for this vulnerability on Ubuntu 19.04?
Update libtiff-tools package to version 4.0.10-4ubuntu0.1.
6
What is the recommended remedy for this vulnerability on Ubuntu 18.04?
Update libtiff-tools package to version 4.0.9-5ubuntu0.3.
7
What is the recommended remedy for this vulnerability on Ubuntu 16.04?
Update libtiff-tools package to version 4.0.6-1ubuntu0.7.
8
Where can I find more information about this vulnerability?
You can find more information about this vulnerability on the Ubuntu Security Notices page.