LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
BID:73441
Info
LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
| Bugtraq ID: | 73441 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2014-9655 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2015 12:00AM |
| Updated: | Sep 28 2016 01:01AM |
| Credit: | Even Rouault |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Oracle VM Server for x86 3.4 Oracle VM Server for x86 3.3 Oracle Linux 7.0 Oracle Linux 6.0 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 LibTIFF LibTIFF 4.0.3 LibTIFF LibTIFF 4.0.2 LibTIFF LibTIFF 3.9.4 LibTIFF LibTIFF 3.9.3 LibTIFF LibTIFF 3.9.2 LibTIFF LibTIFF 3.9 LibTIFF LibTIFF 3.8.2 LibTIFF LibTIFF 3.8.1 LibTIFF LibTIFF 3.8 LibTIFF LibTIFF 3.7.4 LibTIFF LibTIFF 3.7.3 LibTIFF LibTIFF 3.7.1 LibTIFF LibTIFF 3.7 LibTIFF LibTIFF 3.6.1 LibTIFF LibTIFF 3.6 LibTIFF LibTIFF 3.5.7 LibTIFF LibTIFF 3.5.6 LibTIFF LibTIFF 3.5.5 LibTIFF LibTIFF 3.5.4 LibTIFF LibTIFF 3.5.3 LibTIFF LibTIFF 3.5.2 LibTIFF LibTIFF 3.5.1 LibTIFF LibTIFF 3.4 LibTIFF LibTIFF 4.0.1 LibTIFF LibTIFF 4.0 LibTIFF LibTIFF 3.9.5 LibTIFF LibTIFF 3.9.1 LibTIFF LibTIFF 3.9 LibTIFF LibTIFF 3.4 IBM SmartCloud Entry 3.2 IBM SmartCloud Entry 3.1 IBM SmartCloud Entry 2.3 Fix Pack 1 IBM SmartCloud Entry 2.3 Appliance fix pack 6 IBM SmartCloud Entry 2.3 Appliance fix pack 4 IBM SmartCloud Entry 2.2 Fix Pack 2 IBM SmartCloud Entry 2.2 Fix Pack 1 IBM SmartCloud Entry 2.2 Appliance fix pack 6 IBM SmartCloud Entry 2.2 Appliance fix pack 4 IBM SmartCloud Entry 2.2 IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 2.4.0.4 Appliance Fi IBM SmartCloud Entry 2.4.0 IBM SmartCloud Entry 2.3.0.4 Appliance Fi IBM SmartCloud Entry 2.3.0 IBM SmartCloud Entry 2.2.0.4 Appliance Fi IBM SmartCloud Entry 2.2.0.3 Appliance FP IBM SmartCloud Entry 2.2.0.3 Appliance FP IBM PowerKVM 3.1 IBM PowerKVM 2.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
LibTIFF is prone to multiple memory-corruption vulnerabilities.
Attackers can exploit these issues to obtain sensitive information or crash the application resulting in a denial-of-service condition.
LibTIFF is prone to multiple memory-corruption vulnerabilities.
Attackers can exploit these issues to obtain sensitive information or crash the application resulting in a denial-of-service condition.
Exploit / POC
LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
LibTIFF CVE-2014-9655 Multiple Memory Corruption Vulnerabilities
References:
References:
- Bug 1190703 - (CVE-2014-9655) CVE-2014-9655 libtiff: use of uninitialized memory (Red Hat Bugzilla)
- LibTIFF Homepage (LibTIFF)
- Oracle Linux Bulletin - July 2016 (Oracle)
- isg3T1024132:Multiple vulnerabilities in libtiff affect PowerKVM (IBM)
- isg3T1024193: Libtiff vulnerabilities affect IBM SmartClound Entry (IBM)
- libtiff/tif_next.c: add new tests to check that we don't read outsi�?� (LibTIFF)
- Oracle VM Server for x86 Bulletin - July 2016 (Oracle)