Debian alert DLA-1377-1 (tiff)

From:
    	     
 
Hugo Lefeuvre <hle@debian.org> 
To:
    	     
 
debian-lts-announce@lists.debian.org 
Subject:
    	     
 
[SECURITY] [DLA 1377-1] tiff security update 
Date:
    	     
 
Sun, 13 May 2018 21:08:22 -0400
Message-ID:
    	     
 
<20180514010822.GA24294@hle-laptop.local>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : tiff
Version        : 4.0.2-6+deb7u20
CVE ID         : CVE-2018-8905
Debian Bug     : 893806 

A heap-based buffer overflow was discovered in the LZWDecodeCompat
function in tif_lzw.c (LibTIFF 4.0.9 and earlier). This vulnerability
might be leveraged by remote attackers to crash the client via a
crafted TIFF LZW file.

For Debian 7 "Wheezy", these problems have been fixed in version
4.0.2-6+deb7u20.

We recommend that you upgrade your tiff packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE5LpPtQuYJzvmooL3LVy48vb3khkFAlr44RIACgkQLVy48vb3
khnWgAf8CTgLA1I8ztCE6crlr0jRrTKUhdguFS4gl2WqnZtVeuX19W45UfAWUVuv
6EGsVKKoEBmC6NnxrkxzfhB2enW3zbuax3VT1vwM1clscuE/vxbPNcEw3sZakl/3
4v2/+xnMT5mAOzNVZV1pcO8naIF3MeveOLfrGM+Y53CadPo8ZeswgZvRdE2sChCd
jvWtsRUV9KMYGCNiH5Am2GyL+7tQKgVuBA6DT0mJbzWn46rA2Ld8/jyPRzzlZOKJ
hWvCeAe9RnTICbXNcsQN7F5BPkBi4tI0ETOSWN+plc4TTNQp7xoGOZqaneHRuoh0
R/IOS5DQ33I05zQrV/Cn1/yn1mXY7A==
=mrNK
-----END PGP SIGNATURE-----