bugtraq - [ MDVSA-2011:043 ] libtiff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1PwwHd-0003ob-IC@titan.mandriva.com>
Date: Tue, 08 Mar 2011 13:45:01 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2011:043 ] libtiff

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:043
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libtiff
 Date    : March 8, 2011
 Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A buffer overflow was discovered in libtiff which allows remote
 attackers to execute arbitrary code or cause a denial of service
 (application crash) via a crafted TIFF image with CCITT Group 4
 encoding (CVE-2011-0192).
 
 Additionally it was discovered that the fixes for CVE-2009-2347 and
 CVE-2010-2065 were incomplete for Mandriva Linux 2010.0 and 2010.2
 and being resolved as well.
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=490
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0192
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2347
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2065
 http://support.apple.com/kb/HT4554
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 6161b79e9a210ef10136cf522fcae735  2009.0/i586/libtiff3-3.8.2-12.4mdv2009.0.i586.rpm
 a4c724e9889a465d7c3f80618c137a6e  2009.0/i586/libtiff3-devel-3.8.2-12.4mdv2009.0.i586.rpm
 59bd1f954344f75c89562942b8e67f26  2009.0/i586/libtiff3-static-devel-3.8.2-12.4mdv2009.0.i586.rpm
 f0e36e04e25d5f7194d51c8ec5aceace  2009.0/i586/libtiff-progs-3.8.2-12.4mdv2009.0.i586.rpm 
 4dba15dd4b9930f9eb8819feea83fdc2  2009.0/SRPMS/libtiff-3.8.2-12.4mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 43bd1b087e1bd33785e0391508958cc0  2009.0/x86_64/lib64tiff3-3.8.2-12.4mdv2009.0.x86_64.rpm
 a4c118fd83be8cc4e68bcfef5364c768  2009.0/x86_64/lib64tiff3-devel-3.8.2-12.4mdv2009.0.x86_64.rpm
 134ae47488e549ef44b37467039d8c48  2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.4mdv2009.0.x86_64.rpm
 96a726fe5e7bdd10c4add7b5b6a9765f  2009.0/x86_64/libtiff-progs-3.8.2-12.4mdv2009.0.x86_64.rpm 
 4dba15dd4b9930f9eb8819feea83fdc2  2009.0/SRPMS/libtiff-3.8.2-12.4mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 d473eec0df8bf76047b4cc9fd039517f  2010.0/i586/libtiff3-3.9.1-4.3mdv2010.0.i586.rpm
 571154033ffa0756e3280822220a2903  2010.0/i586/libtiff-devel-3.9.1-4.3mdv2010.0.i586.rpm
 7dbf407fb2ad92bbcc8e07dd50378145  2010.0/i586/libtiff-progs-3.9.1-4.3mdv2010.0.i586.rpm
 6f00afaaa934688a567fb835fdba6408  2010.0/i586/libtiff-static-devel-3.9.1-4.3mdv2010.0.i586.rpm 
 476e72930534b39b3a233ff39d32b749  2010.0/SRPMS/libtiff-3.9.1-4.3mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 9b00125f6db8ef5f0007015f824a2297  2010.0/x86_64/lib64tiff3-3.9.1-4.3mdv2010.0.x86_64.rpm
 5bce8273b1596a72b20762a2a10a4ba5  2010.0/x86_64/lib64tiff-devel-3.9.1-4.3mdv2010.0.x86_64.rpm
 1dfce1fe83cc7e20fb28ed6b90620cb6  2010.0/x86_64/lib64tiff-static-devel-3.9.1-4.3mdv2010.0.x86_64.rpm
 e945257630a37a38ff6a182fcb9a3983  2010.0/x86_64/libtiff-progs-3.9.1-4.3mdv2010.0.x86_64.rpm 
 476e72930534b39b3a233ff39d32b749  2010.0/SRPMS/libtiff-3.9.1-4.3mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 1ebefe4b147df76b2432e35efb6ccc68  2010.1/i586/libtiff3-3.9.2-2.3mdv2010.2.i586.rpm
 3b3f043455d4fa867de179c0d445812f  2010.1/i586/libtiff-devel-3.9.2-2.3mdv2010.2.i586.rpm
 a4c9326657d3fa9c238c59a0a54c5fa5  2010.1/i586/libtiff-progs-3.9.2-2.3mdv2010.2.i586.rpm
 bec7660cf735caef3d795254ee12dfb8  2010.1/i586/libtiff-static-devel-3.9.2-2.3mdv2010.2.i586.rpm 
 11d15974ed4ffe30164791e0603dff7e  2010.1/SRPMS/libtiff-3.9.2-2.3mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 72ce70d9e1db8e677ec346e69aa57469  2010.1/x86_64/lib64tiff3-3.9.2-2.3mdv2010.2.x86_64.rpm
 b09392f442a6f79a3b7b668b15fb93b6  2010.1/x86_64/lib64tiff-devel-3.9.2-2.3mdv2010.2.x86_64.rpm
 fdfd079e10cfd09d27771bf6d95610f2  2010.1/x86_64/lib64tiff-static-devel-3.9.2-2.3mdv2010.2.x86_64.rpm
 763fb491e5896c4c4cddb46e0935a69e  2010.1/x86_64/libtiff-progs-3.9.2-2.3mdv2010.2.x86_64.rpm 
 11d15974ed4ffe30164791e0603dff7e  2010.1/SRPMS/libtiff-3.9.2-2.3mdv2010.2.src.rpm

 Corporate 4.0:
 3ff2e1a4ef40b7da017d2d508037434b  corporate/4.0/i586/libtiff3-3.6.1-12.10.20060mlcs4.i586.rpm
 64a74440c32e4dbd0f27148400b2277f  corporate/4.0/i586/libtiff3-devel-3.6.1-12.10.20060mlcs4.i586.rpm
 5849512079a3fccfd6794ad516585c0b  corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.10.20060mlcs4.i586.rpm
 70fa38c74000f8c6a00c5f13611a41fb  corporate/4.0/i586/libtiff-progs-3.6.1-12.10.20060mlcs4.i586.rpm 
 d3cb50ab91beab6a422425dc024c41ef  corporate/4.0/SRPMS/libtiff-3.6.1-12.10.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 09375d3d22f0e7486194927ecb219269  corporate/4.0/x86_64/lib64tiff3-3.6.1-12.10.20060mlcs4.x86_64.rpm
 35badc0f9c59049faa0c47e2bf71a97e  corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.10.20060mlcs4.x86_64.rpm
 96ec56339c5bb9e6ddbd98cdb179c397  corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.10.20060mlcs4.x86_64.rpm
 136c5faf1a6eb66b156986faf5782ec6  corporate/4.0/x86_64/libtiff-progs-3.6.1-12.10.20060mlcs4.x86_64.rpm 
 d3cb50ab91beab6a422425dc024c41ef  corporate/4.0/SRPMS/libtiff-3.6.1-12.10.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 db92b7deb5c1ebd74a8daf44437afaa1  mes5/i586/libtiff3-3.8.2-12.4mdvmes5.1.i586.rpm
 31465ba8554e93c9f83857906c2ac485  mes5/i586/libtiff3-devel-3.8.2-12.4mdvmes5.1.i586.rpm
 826524e4a99a8607075fb7969b100a66  mes5/i586/libtiff3-static-devel-3.8.2-12.4mdvmes5.1.i586.rpm
 239db171a27266491b01d4709f6c3970  mes5/i586/libtiff-progs-3.8.2-12.4mdvmes5.1.i586.rpm 
 e0b336563cf715de1750ac83eb852683  mes5/SRPMS/libtiff-3.8.2-12.4mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 def4750ff7298b1c47690444eb3dab53  mes5/x86_64/lib64tiff3-3.8.2-12.4mdvmes5.1.x86_64.rpm
 957e1a10a6785ce5c499e3baf50a674e  mes5/x86_64/lib64tiff3-devel-3.8.2-12.4mdvmes5.1.x86_64.rpm
 8f74482ce1c2468095de1994ba833e57  mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.4mdvmes5.1.x86_64.rpm
 93c37769ad6892568dd7370b9ed0a153  mes5/x86_64/libtiff-progs-3.8.2-12.4mdvmes5.1.x86_64.rpm 
 e0b336563cf715de1750ac83eb852683  mes5/SRPMS/libtiff-3.8.2-12.4mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNdfPMmqjQ0CJFipgRAlWhAJ0TN3TM2EGQ8y8oOGPUzc6XUh9k7gCeO5or
M0cqjMlEAimireuDvfoMuyM=
=6LMz
-----END PGP SIGNATURE-----