full-disclosure - [ MDVSA-2010:145 ] libtiff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1OhPH7-00030n-LR@titan.mandriva.com>
Date: Fri, 06 Aug 2010 17:56:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:145 ] libtiff

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:145
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libtiff
 Date    : August 6, 2010
 Affected: 2008.0, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in libtiff:
 
 The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in
 ImageMagick, does not properly handle invalid ReferenceBlackWhite
 values, which allows remote attackers to cause a denial of service
 (application crash) via a crafted TIFF image that triggers an array
 index error, related to downsampled OJPEG input. (CVE-2010-2595)
 
 Multiple integer overflows in the Fax3SetupState function in tif_fax3.c
 in the FAX3 decoder in LibTIFF before 3.9.3 allow remote attackers to
 execute arbitrary code or cause a denial of service (application crash)
 via a crafted TIFF file that triggers a heap-based buffer overflow
 (CVE-2010-1411).
 
 Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3
 allows remote attackers to cause a denial of service (application
 crash) or possibly execute arbitrary code via a crafted TIFF file
 that triggers a buffer overflow (CVE-2010-2065).
 
 The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers
 to cause a denial of service (out-of-bounds read and application crash)
 via a TIFF file with an invalid combination of SamplesPerPixel and
 Photometric values (CVE-2010-2483).
 
 The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2
 makes incorrect calls to the TIFFGetField function, which allows
 remote attackers to cause a denial of service (application crash) via
 a crafted TIFF image, related to downsampled OJPEG input and possibly
 related to a compiler optimization that triggers a divide-by-zero error
 (CVE-2010-2597).
 
 The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly
 handle unknown tag types in TIFF directory entries, which allows
 remote attackers to cause a denial of service (out-of-bounds read
 and application crash) via a crafted TIFF file (CVE-2010-248).
 
 Packages for 2008.0 and 2009.0 are provided as of the Extended
 Maintenance Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2595
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1411
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2065
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2483
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2597
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2481
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 7f2c540142f1f0027e1af0bb5e5d6b9b  2008.0/i586/libtiff3-3.8.2-8.3mdv2008.0.i586.rpm
 2fe28407ec2158370391fde6671ce887  2008.0/i586/libtiff3-devel-3.8.2-8.3mdv2008.0.i586.rpm
 a63c74c604a64147e98b578fb14d8bb1  2008.0/i586/libtiff3-static-devel-3.8.2-8.3mdv2008.0.i586.rpm
 c6f6793532e54f0f429b0d7f2fb5cc53  2008.0/i586/libtiff-progs-3.8.2-8.3mdv2008.0.i586.rpm 
 1e9fce7b929a3abe76cf3a64984e2768  2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 ca769ee7dc0c489efa24b5bae4872324  2008.0/x86_64/lib64tiff3-3.8.2-8.3mdv2008.0.x86_64.rpm
 9437088dbe56fdeffe279200b1252bc0  2008.0/x86_64/lib64tiff3-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
 a36d2b3936381b0917169940751035e9  2008.0/x86_64/lib64tiff3-static-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
 a754d8268b77e094829f46f4909253ed  2008.0/x86_64/libtiff-progs-3.8.2-8.3mdv2008.0.x86_64.rpm 
 1e9fce7b929a3abe76cf3a64984e2768  2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 eca3a746733b5c1d336ecd334660f765  2009.0/i586/libtiff3-3.8.2-12.3mdv2009.0.i586.rpm
 88afdbf2d9f57d887e7d88c0a47aa7cb  2009.0/i586/libtiff3-devel-3.8.2-12.3mdv2009.0.i586.rpm
 42351524386fdf9f6f0db6a890f90d15  2009.0/i586/libtiff3-static-devel-3.8.2-12.3mdv2009.0.i586.rpm
 e2597dcb8dd52b9b9b89ed4a7e9a7457  2009.0/i586/libtiff-progs-3.8.2-12.3mdv2009.0.i586.rpm 
 eb278dd00fcdba1a9a022b26b40b8f7b  2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 a4dd4241cbf68a3800d955b56d96fc3a  2009.0/x86_64/lib64tiff3-3.8.2-12.3mdv2009.0.x86_64.rpm
 15dfa93a715fea30f87d47957d405614  2009.0/x86_64/lib64tiff3-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
 b90de01cd1f67c4b36a6a1a4478f40ae  2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
 c39509d570099a3333dafb3c405be826  2009.0/x86_64/libtiff-progs-3.8.2-12.3mdv2009.0.x86_64.rpm 
 eb278dd00fcdba1a9a022b26b40b8f7b  2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 470a637b4fcccd4e177f39ecfc1193da  2009.1/i586/libtiff3-3.8.2-13.2mdv2009.1.i586.rpm
 a7adcfce77932c3d26100ed29a3a82a1  2009.1/i586/libtiff3-devel-3.8.2-13.2mdv2009.1.i586.rpm
 9699f07b73466260f2910bf714ce56c1  2009.1/i586/libtiff3-static-devel-3.8.2-13.2mdv2009.1.i586.rpm
 858cd94ead532044b99a40d793e3fbab  2009.1/i586/libtiff-progs-3.8.2-13.2mdv2009.1.i586.rpm 
 de1744758df19a271525d440d8e4016c  2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 e05c9cf64635f733396650b1140b5613  2009.1/x86_64/lib64tiff3-3.8.2-13.2mdv2009.1.x86_64.rpm
 002c8b1fff51881ac7181c14ec9b56b0  2009.1/x86_64/lib64tiff3-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
 f426223cfecb243643bcf46d6fbe5634  2009.1/x86_64/lib64tiff3-static-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
 d66754ae9d5351c4747fcc6c5eb3f4dc  2009.1/x86_64/libtiff-progs-3.8.2-13.2mdv2009.1.x86_64.rpm 
 de1744758df19a271525d440d8e4016c  2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

 Corporate 4.0:
 6464aada6be88ca85416e3522851ee1e  corporate/4.0/i586/libtiff3-3.6.1-12.9.20060mlcs4.i586.rpm
 00e9a5fa7a65674874338f6646996f84  corporate/4.0/i586/libtiff3-devel-3.6.1-12.9.20060mlcs4.i586.rpm
 b91ffa15bdc2bc7c5e8500a15594a0d7  corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.9.20060mlcs4.i586.rpm
 fb0919db56d53a7994022b27dc4a987f  corporate/4.0/i586/libtiff-progs-3.6.1-12.9.20060mlcs4.i586.rpm 
 3097d3095f2758050121bd7c1d274db2  corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 320a589cc69ce0fbbdda5b0be55469d4  corporate/4.0/x86_64/lib64tiff3-3.6.1-12.9.20060mlcs4.x86_64.rpm
 164bbdf3291573b99304d785b63aa4d8  corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
 aaadd8deff51408f2d9ea7712202440e  corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
 669f636420cf955a797ecea72c0f4aa7  corporate/4.0/x86_64/libtiff-progs-3.6.1-12.9.20060mlcs4.x86_64.rpm 
 3097d3095f2758050121bd7c1d274db2  corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 714eef6124b23c07d716a1088c961e8b  mes5/i586/libtiff3-3.8.2-12.3mdvmes5.1.i586.rpm
 4582318959daf3a89526f9e856d63b2a  mes5/i586/libtiff3-devel-3.8.2-12.3mdvmes5.1.i586.rpm
 a1ecf2254bbf472db01724e8a69a5648  mes5/i586/libtiff3-static-devel-3.8.2-12.3mdvmes5.1.i586.rpm
 6c67e9c5dab96a18ca157c60a61a04df  mes5/i586/libtiff-progs-3.8.2-12.3mdvmes5.1.i586.rpm 
 111eeb73e8c6893434da73e58726f8f2  mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 2908165921a479bd8765c5163857c1ba  mes5/x86_64/lib64tiff3-3.8.2-12.3mdvmes5.1.x86_64.rpm
 d5414e97a052e6bbec454d2984088b2c  mes5/x86_64/lib64tiff3-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
 9beda798ab71763f2cbc6c645f4a0eaa  mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
 553379c5478d919c1388e13a08a39858  mes5/x86_64/libtiff-progs-3.8.2-12.3mdvmes5.1.x86_64.rpm 
 111eeb73e8c6893434da73e58726f8f2  mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMXAAdmqjQ0CJFipgRAiYVAKC4U2WZPi5dPJwlwu680NDP7rxjqwCguxkQ
pwXhgfBlp5fm43Y0A/MZ+O8=
=s+AF
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/