SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   LibTIFF Vendors:   libtiff.org
(Fedora Issues Fix for FC2) LibTIFF Integer Overflows Let Remote Users Crash the Application
SecurityTracker Alert ID:  1011702
SecurityTracker URL:  http://securitytracker.com/id/1011702
CVE Reference:   CVE-2004-0886   (Links to External Site)
Date:  Oct 15 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Some vulnerabilities were reported in LibTIFF. A remote user can cause an application using LibTIFF to crash.

Red Hat reported that a remote user can create a specially crafted image file that, when loaded by the target user, will trigger an integer overflow and cause LibTIFF to crash.

Dimitry Levin is credited with reporting this flaw.

Impact:   A remote user can cause the target application to crash.
Solution:   Fedora has released a fix, available at:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

176b76f644d44964a485e71ea09c814b SRPMS/libtiff-3.5.7-20.2.src.rpm
a53252dfa36355bc7afb44f68de3534f x86_64/libtiff-3.5.7-20.2.x86_64.rpm
72f0b77f45916d20a8517d7cf9b80e1d
x86_64/libtiff-devel-3.5.7-20.2.x86_64.rpm
7b17b8e556b04850231efef0e38bf582
x86_64/debug/libtiff-debuginfo-3.5.7-20.2.x86_64.rpm
f86f0dec436740a312ad310140a3d537 x86_64/libtiff-3.5.7-20.2.i386.rpm
f86f0dec436740a312ad310140a3d537 i386/libtiff-3.5.7-20.2.i386.rpm
d78da339e6ac75c8bad8d6c87ca8c232 i386/libtiff-devel-3.5.7-20.2.i386.rpm
fcb92220b830cce1c65a844d52e6d07d
i386/debug/libtiff-debuginfo-3.5.7-20.2.i386.rpm

Vendor URL:  www.libtiff.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Red Hat Fedora)
Underlying OS Comments:  FC2

Message History:   This archive entry is a follow-up to the message listed below.
Oct 14 2004 LibTIFF Integer Overflows Let Remote Users Crash the Application



 Source Message Contents

Subject:  [SECURITY] Fedora Core 2 Update: libtiff-3.5.7-20.2


---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-334
2004-10-14
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : libtiff
Version     : 3.5.7                      
Release     : 20.2                  
Summary     : A library of functions for manipulating TIFF format image
files.
Description :
The libtiff package contains a library of functions for manipulating
TIFF (Tagged Image File Format) image format files.  TIFF is a widely
used file format for bitmapped images.  TIFF files usually end in the
.tif extension and they are often quite large.

The libtiff package should be installed if you need to manipulate TIFF
format image files.

---------------------------------------------------------------------
Update Information:

The libtiff package contains a library of functions for manipulating
TIFF
(Tagged Image File Format) image format files. TIFF is a widely used
file
format for bitmapped images.

During a source code audit, Chris Evans discovered a number of integer
overflow bugs that affect libtiff. An attacker who has the ability to
trick
a user into opening a malicious TIFF file could cause the application
linked to libtiff to crash or possibly execute arbitrary code. The
Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0886 to this issue.

Additionally, a number of buffer overflow bugs that affect libtiff have
been found. An attacker who has the ability to trick a user into opening
a
malicious TIFF file could cause the application linked to libtiff to
crash
or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0803 to
this issue.

All users are advised to upgrade to these errata packages, which contain
fixes for these issues. 
---------------------------------------------------------------------
* Thu Oct 07 2004 Matthias Clasen <mclasen@redhat.com>

- fix some integer and buffer overflows (#134853, #134848)


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

176b76f644d44964a485e71ea09c814b  SRPMS/libtiff-3.5.7-20.2.src.rpm
a53252dfa36355bc7afb44f68de3534f  x86_64/libtiff-3.5.7-20.2.x86_64.rpm
72f0b77f45916d20a8517d7cf9b80e1d 
x86_64/libtiff-devel-3.5.7-20.2.x86_64.rpm
7b17b8e556b04850231efef0e38bf582 
x86_64/debug/libtiff-debuginfo-3.5.7-20.2.x86_64.rpm
f86f0dec436740a312ad310140a3d537  x86_64/libtiff-3.5.7-20.2.i386.rpm
f86f0dec436740a312ad310140a3d537  i386/libtiff-3.5.7-20.2.i386.rpm
d78da339e6ac75c8bad8d6c87ca8c232  i386/libtiff-devel-3.5.7-20.2.i386.rpm
fcb92220b830cce1c65a844d52e6d07d 
i386/debug/libtiff-debuginfo-3.5.7-20.2.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------



--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC