what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2010-145

Mandriva Linux Security Advisory 2010-145
Posted Aug 6, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-145 - The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service via a crafted TIFF image that triggers an array index error, related to downsampled OJPEG input. Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTIFF before 3.9.3 allow remote attackers to execute arbitrary code or cause a denial of service via a crafted TIFF file that triggers a heap-based buffer overflow. Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow. The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values. The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to downsampled OJPEG input and possibly related to a compiler optimization that triggers a divide-by-zero error. The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.

tags | advisory, remote, denial of service, overflow, arbitrary
systems | linux, mandriva
advisories | CVE-2010-2595, CVE-2010-1411, CVE-2010-2065, CVE-2010-2483, CVE-2010-2597, CVE-2010-2481
SHA-256 | 25f14ded470d4ea2318841b1889fdb846d07a7f1783d57bb25b0010d9d997aa0

Mandriva Linux Security Advisory 2010-145

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:145
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libtiff
Date : August 6, 2010
Affected: 2008.0, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in libtiff:

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in
ImageMagick, does not properly handle invalid ReferenceBlackWhite
values, which allows remote attackers to cause a denial of service
(application crash) via a crafted TIFF image that triggers an array
index error, related to downsampled OJPEG input. (CVE-2010-2595)

Multiple integer overflows in the Fax3SetupState function in tif_fax3.c
in the FAX3 decoder in LibTIFF before 3.9.3 allow remote attackers to
execute arbitrary code or cause a denial of service (application crash)
via a crafted TIFF file that triggers a heap-based buffer overflow
(CVE-2010-1411).

Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3
allows remote attackers to cause a denial of service (application
crash) or possibly execute arbitrary code via a crafted TIFF file
that triggers a buffer overflow (CVE-2010-2065).

The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers
to cause a denial of service (out-of-bounds read and application crash)
via a TIFF file with an invalid combination of SamplesPerPixel and
Photometric values (CVE-2010-2483).

The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2
makes incorrect calls to the TIFFGetField function, which allows
remote attackers to cause a denial of service (application crash) via
a crafted TIFF image, related to downsampled OJPEG input and possibly
related to a compiler optimization that triggers a divide-by-zero error
(CVE-2010-2597).

The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly
handle unknown tag types in TIFF directory entries, which allows
remote attackers to cause a denial of service (out-of-bounds read
and application crash) via a crafted TIFF file (CVE-2010-248).

Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2595
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2065
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2481
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
7f2c540142f1f0027e1af0bb5e5d6b9b 2008.0/i586/libtiff3-3.8.2-8.3mdv2008.0.i586.rpm
2fe28407ec2158370391fde6671ce887 2008.0/i586/libtiff3-devel-3.8.2-8.3mdv2008.0.i586.rpm
a63c74c604a64147e98b578fb14d8bb1 2008.0/i586/libtiff3-static-devel-3.8.2-8.3mdv2008.0.i586.rpm
c6f6793532e54f0f429b0d7f2fb5cc53 2008.0/i586/libtiff-progs-3.8.2-8.3mdv2008.0.i586.rpm
1e9fce7b929a3abe76cf3a64984e2768 2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
ca769ee7dc0c489efa24b5bae4872324 2008.0/x86_64/lib64tiff3-3.8.2-8.3mdv2008.0.x86_64.rpm
9437088dbe56fdeffe279200b1252bc0 2008.0/x86_64/lib64tiff3-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
a36d2b3936381b0917169940751035e9 2008.0/x86_64/lib64tiff3-static-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
a754d8268b77e094829f46f4909253ed 2008.0/x86_64/libtiff-progs-3.8.2-8.3mdv2008.0.x86_64.rpm
1e9fce7b929a3abe76cf3a64984e2768 2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

Mandriva Linux 2009.0:
eca3a746733b5c1d336ecd334660f765 2009.0/i586/libtiff3-3.8.2-12.3mdv2009.0.i586.rpm
88afdbf2d9f57d887e7d88c0a47aa7cb 2009.0/i586/libtiff3-devel-3.8.2-12.3mdv2009.0.i586.rpm
42351524386fdf9f6f0db6a890f90d15 2009.0/i586/libtiff3-static-devel-3.8.2-12.3mdv2009.0.i586.rpm
e2597dcb8dd52b9b9b89ed4a7e9a7457 2009.0/i586/libtiff-progs-3.8.2-12.3mdv2009.0.i586.rpm
eb278dd00fcdba1a9a022b26b40b8f7b 2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
a4dd4241cbf68a3800d955b56d96fc3a 2009.0/x86_64/lib64tiff3-3.8.2-12.3mdv2009.0.x86_64.rpm
15dfa93a715fea30f87d47957d405614 2009.0/x86_64/lib64tiff3-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
b90de01cd1f67c4b36a6a1a4478f40ae 2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
c39509d570099a3333dafb3c405be826 2009.0/x86_64/libtiff-progs-3.8.2-12.3mdv2009.0.x86_64.rpm
eb278dd00fcdba1a9a022b26b40b8f7b 2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

Mandriva Linux 2009.1:
470a637b4fcccd4e177f39ecfc1193da 2009.1/i586/libtiff3-3.8.2-13.2mdv2009.1.i586.rpm
a7adcfce77932c3d26100ed29a3a82a1 2009.1/i586/libtiff3-devel-3.8.2-13.2mdv2009.1.i586.rpm
9699f07b73466260f2910bf714ce56c1 2009.1/i586/libtiff3-static-devel-3.8.2-13.2mdv2009.1.i586.rpm
858cd94ead532044b99a40d793e3fbab 2009.1/i586/libtiff-progs-3.8.2-13.2mdv2009.1.i586.rpm
de1744758df19a271525d440d8e4016c 2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
e05c9cf64635f733396650b1140b5613 2009.1/x86_64/lib64tiff3-3.8.2-13.2mdv2009.1.x86_64.rpm
002c8b1fff51881ac7181c14ec9b56b0 2009.1/x86_64/lib64tiff3-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
f426223cfecb243643bcf46d6fbe5634 2009.1/x86_64/lib64tiff3-static-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
d66754ae9d5351c4747fcc6c5eb3f4dc 2009.1/x86_64/libtiff-progs-3.8.2-13.2mdv2009.1.x86_64.rpm
de1744758df19a271525d440d8e4016c 2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

Corporate 4.0:
6464aada6be88ca85416e3522851ee1e corporate/4.0/i586/libtiff3-3.6.1-12.9.20060mlcs4.i586.rpm
00e9a5fa7a65674874338f6646996f84 corporate/4.0/i586/libtiff3-devel-3.6.1-12.9.20060mlcs4.i586.rpm
b91ffa15bdc2bc7c5e8500a15594a0d7 corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.9.20060mlcs4.i586.rpm
fb0919db56d53a7994022b27dc4a987f corporate/4.0/i586/libtiff-progs-3.6.1-12.9.20060mlcs4.i586.rpm
3097d3095f2758050121bd7c1d274db2 corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
320a589cc69ce0fbbdda5b0be55469d4 corporate/4.0/x86_64/lib64tiff3-3.6.1-12.9.20060mlcs4.x86_64.rpm
164bbdf3291573b99304d785b63aa4d8 corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
aaadd8deff51408f2d9ea7712202440e corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
669f636420cf955a797ecea72c0f4aa7 corporate/4.0/x86_64/libtiff-progs-3.6.1-12.9.20060mlcs4.x86_64.rpm
3097d3095f2758050121bd7c1d274db2 corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
714eef6124b23c07d716a1088c961e8b mes5/i586/libtiff3-3.8.2-12.3mdvmes5.1.i586.rpm
4582318959daf3a89526f9e856d63b2a mes5/i586/libtiff3-devel-3.8.2-12.3mdvmes5.1.i586.rpm
a1ecf2254bbf472db01724e8a69a5648 mes5/i586/libtiff3-static-devel-3.8.2-12.3mdvmes5.1.i586.rpm
6c67e9c5dab96a18ca157c60a61a04df mes5/i586/libtiff-progs-3.8.2-12.3mdvmes5.1.i586.rpm
111eeb73e8c6893434da73e58726f8f2 mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
2908165921a479bd8765c5163857c1ba mes5/x86_64/lib64tiff3-3.8.2-12.3mdvmes5.1.x86_64.rpm
d5414e97a052e6bbec454d2984088b2c mes5/x86_64/lib64tiff3-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
9beda798ab71763f2cbc6c645f4a0eaa mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
553379c5478d919c1388e13a08a39858 mes5/x86_64/libtiff-progs-3.8.2-12.3mdvmes5.1.x86_64.rpm
111eeb73e8c6893434da73e58726f8f2 mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMXAAdmqjQ0CJFipgRAiYVAKC4U2WZPi5dPJwlwu680NDP7rxjqwCguxkQ
pwXhgfBlp5fm43Y0A/MZ+O8=
=s+AF
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close