Message-Id: <E1MQSLZ-0005ON-R6@titan.mandriva.com>
Date: Mon, 13 Jul 2009 22:42:01 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2009:150 ] libtiff


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:150
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libtiff
 Date    : July 13, 2009
 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in libtiff:
 
 Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2
 allows context-dependent attackers to cause a denial of service (crash)
 via a crafted TIFF image, a different vulnerability than CVE-2008-2327
 (CVE-2009-2285).
 
 Fix several places in tiff2rgba and rgb2ycbcr that were being careless
 about possible integer overflow in calculation of buffer sizes
 (CVE-2009-2347).
 
 This update provides fixes for these vulnerabilities.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2285
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2347
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 7c56d843d17efce1717654ceb4efe3e1  2008.1/i586/libtiff3-3.8.2-10.2mdv2008.1.i586.rpm
 9d02ed754eafe7a33b2fb4b5a8e7b1d1  2008.1/i586/libtiff3-devel-3.8.2-10.2mdv2008.1.i586.rpm
 619b12e1013c645db1aca659b1ea6805  2008.1/i586/libtiff3-static-devel-3.8.2-10.2mdv2008.1.i586.rpm
 5d94641411d637493e7e413045fa82a9  2008.1/i586/libtiff-progs-3.8.2-10.2mdv2008.1.i586.rpm 
 73795a036f1b81ca0c1233df6f7d8fad  2008.1/SRPMS/libtiff-3.8.2-10.2mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 52e0eb4a0230bbdb245b787ba53c0903  2008.1/x86_64/lib64tiff3-3.8.2-10.2mdv2008.1.x86_64.rpm
 147525496bca6fcee3a741f2350e8441  2008.1/x86_64/lib64tiff3-devel-3.8.2-10.2mdv2008.1.x86_64.rpm
 c4ed6f9405dcb64edfebba00272f7596  2008.1/x86_64/lib64tiff3-static-devel-3.8.2-10.2mdv2008.1.x86_64.rpm
 0844ecf1e6941fbde9fc358e34a3136e  2008.1/x86_64/libtiff-progs-3.8.2-10.2mdv2008.1.x86_64.rpm 
 73795a036f1b81ca0c1233df6f7d8fad  2008.1/SRPMS/libtiff-3.8.2-10.2mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 75efa7472bffceaecb10016c22621de7  2009.0/i586/libtiff3-3.8.2-12.1mdv2009.0.i586.rpm
 aa82f5e49bb942688cbc85d55318b290  2009.0/i586/libtiff3-devel-3.8.2-12.1mdv2009.0.i586.rpm
 0a93799b79a70ab2a900d12030907e78  2009.0/i586/libtiff3-static-devel-3.8.2-12.1mdv2009.0.i586.rpm
 efe9ac463f0b551859c8349c8c63e288  2009.0/i586/libtiff-progs-3.8.2-12.1mdv2009.0.i586.rpm 
 52799196d155f1582dbf5a76ffd93e0e  2009.0/SRPMS/libtiff-3.8.2-12.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 89138d743bbf89abf1f0f879bc2ed829  2009.0/x86_64/lib64tiff3-3.8.2-12.1mdv2009.0.x86_64.rpm
 f5f55f26af4641878dc3a057a764f83a  2009.0/x86_64/lib64tiff3-devel-3.8.2-12.1mdv2009.0.x86_64.rpm
 5a99217d3a034504b4fc4d120764d793  2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.1mdv2009.0.x86_64.rpm
 5abd09147419ec5b4008306a424c22d8  2009.0/x86_64/libtiff-progs-3.8.2-12.1mdv2009.0.x86_64.rpm 
 52799196d155f1582dbf5a76ffd93e0e  2009.0/SRPMS/libtiff-3.8.2-12.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 0a1eace7d782a42df040267874fed9f1  2009.1/i586/libtiff3-3.8.2-13.1mdv2009.1.i586.rpm
 7dd6bd104131b115130e6feeba9d4766  2009.1/i586/libtiff3-devel-3.8.2-13.1mdv2009.1.i586.rpm
 32658d8a98def2e32a757bfb6ea64d28  2009.1/i586/libtiff3-static-devel-3.8.2-13.1mdv2009.1.i586.rpm
 53d18d66fc849a6128e5961d95892e7c  2009.1/i586/libtiff-progs-3.8.2-13.1mdv2009.1.i586.rpm 
 27b6b2d285832c2ab5e8a2c25a6102b3  2009.1/SRPMS/libtiff-3.8.2-13.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 26516d312785c5f9e2a5f37e1651ffbb  2009.1/x86_64/lib64tiff3-3.8.2-13.1mdv2009.1.x86_64.rpm
 91e72dcc4d1866b7978dfcd493393d2e  2009.1/x86_64/lib64tiff3-devel-3.8.2-13.1mdv2009.1.x86_64.rpm
 9a4d6177df03395106d00e7f8a009e2b  2009.1/x86_64/lib64tiff3-static-devel-3.8.2-13.1mdv2009.1.x86_64.rpm
 b0cffa6ebb21e850847089cad50f1e7a  2009.1/x86_64/libtiff-progs-3.8.2-13.1mdv2009.1.x86_64.rpm 
 27b6b2d285832c2ab5e8a2c25a6102b3  2009.1/SRPMS/libtiff-3.8.2-13.1mdv2009.1.src.rpm

 Corporate 3.0:
 5e5facf365d83f647ba3b1c0afecb8c8  corporate/3.0/i586/libtiff3-3.5.7-11.15.C30mdk.i586.rpm
 288ab11a153d4df48c4fadadfab0b653  corporate/3.0/i586/libtiff3-devel-3.5.7-11.15.C30mdk.i586.rpm
 0fa52891fc9cafff6d4b6de9d8a23262  corporate/3.0/i586/libtiff3-static-devel-3.5.7-11.15.C30mdk.i586.rpm
 c4ba5b9ab1caf7cff8addc84d778f4d4  corporate/3.0/i586/libtiff-progs-3.5.7-11.15.C30mdk.i586.rpm 
 72c81050e7296c63de08282f2f369283  corporate/3.0/SRPMS/libtiff-3.5.7-11.15.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 092479cb8de7b269197d06595b68f71c  corporate/3.0/x86_64/lib64tiff3-3.5.7-11.15.C30mdk.x86_64.rpm
 ea7f46c3e639d24f40449b599f5b2382  corporate/3.0/x86_64/lib64tiff3-devel-3.5.7-11.15.C30mdk.x86_64.rpm
 b414cd225488b9a68bbfc611fc72924f  corporate/3.0/x86_64/lib64tiff3-static-devel-3.5.7-11.15.C30mdk.x86_64.rpm
 9f008c60f557b086915e65e78a56ecfd  corporate/3.0/x86_64/libtiff-progs-3.5.7-11.15.C30mdk.x86_64.rpm 
 72c81050e7296c63de08282f2f369283  corporate/3.0/SRPMS/libtiff-3.5.7-11.15.C30mdk.src.rpm

 Corporate 4.0:
 25cd088ef8715634db5dedd68611125e  corporate/4.0/i586/libtiff3-3.6.1-12.8.20060mlcs4.i586.rpm
 e0df8bc6f18fa4e8585734a1541e6849  corporate/4.0/i586/libtiff3-devel-3.6.1-12.8.20060mlcs4.i586.rpm
 b44feabddefea2f192782b6ae313045c  corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.8.20060mlcs4.i586.rpm
 8beb0af53dd07fb685c61a507dda9a00  corporate/4.0/i586/libtiff-progs-3.6.1-12.8.20060mlcs4.i586.rpm 
 b205c0dc185b0a55bd5521d3f6e416f0  corporate/4.0/SRPMS/libtiff-3.6.1-12.8.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 36e6479eacb594dfbb34deff16b99ba5  corporate/4.0/x86_64/lib64tiff3-3.6.1-12.8.20060mlcs4.x86_64.rpm
 0c37e2b3981cb44f25734ad4903aad11  corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.8.20060mlcs4.x86_64.rpm
 08a1408d4aef9a858900c2e7444d2b66  corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.8.20060mlcs4.x86_64.rpm
 ff20e3e86ddb53df420bb3ce78f894ac  corporate/4.0/x86_64/libtiff-progs-3.6.1-12.8.20060mlcs4.x86_64.rpm 
 b205c0dc185b0a55bd5521d3f6e416f0  corporate/4.0/SRPMS/libtiff-3.6.1-12.8.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 134c05da89014e53836b7e6a230a766d  mnf/2.0/i586/libtiff3-3.5.7-11.15.C30mdk.i586.rpm
 81c805e63e9c9c98e135c9b7a6cc1925  mnf/2.0/i586/libtiff3-devel-3.5.7-11.15.C30mdk.i586.rpm
 9aa2e598ce292505a2ef2f3718401e05  mnf/2.0/i586/libtiff3-static-devel-3.5.7-11.15.C30mdk.i586.rpm
 cefb377ab47ead9e47594e9b9e78b676  mnf/2.0/i586/libtiff-progs-3.5.7-11.15.C30mdk.i586.rpm 
 b34af1bd2ec1986ff9dc65efe5d87c43  mnf/2.0/SRPMS/libtiff-3.5.7-11.15.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKW3ZnmqjQ0CJFipgRAnkvAJ98BXT7+cg9tL9H8hucbF5UmcpcPQCgko2O
HW+jXwDDqrNF1u8bY2AmHLA=
=vJdX
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists