Executive Summary
Summary | |
---|---|
Title | libtiff security update |
Informations | |||
---|---|---|---|
Name | RHSA-2010:0519 | First vendor Publication | 2010-07-08 |
Vendor | RedHat | Last vendor Modification | 2010-07-08 |
Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated libtiff packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple integer overflow flaws, leading to a buffer overflow, were discovered in libtiff. An attacker could use these flaws to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2010-1411) Multiple input validation flaws were discovered in libtiff. An attacker could use these flaws to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash. (CVE-2010-2481, CVE-2010-2483, CVE-2010-2595, CVE-2010-2597) Red Hat would like to thank Apple Product Security for responsibly reporting the CVE-2010-1411 flaw, who credit Kevin Finisterre of digitalmunition.com for the discovery of the issue. All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 592361 - CVE-2010-1411 libtiff: integer overflows leading to heap overflow in Fax3SetupState 610684 - CVE-2010-2595 libtiff: Array index error due improper handling of invalid ReferenceBlackWhite values 610776 - CVE-2010-2597 libtiff: use of uninitialized values crash 611895 - CVE-2010-2481 libtiff: TIFFExtractData out-of-bounds read crash 611900 - CVE-2010-2483 libtiff: out-of-bounds read crash on images with invalid SamplesPerPixel values |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2010-0519.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
40 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
40 % | CWE-20 | Improper Input Validation |
20 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:12688 | |||
Oval ID: | oval:org.mitre.oval:def:12688 | ||
Title: | DSA-2084-1 tiff -- integer overflows | ||
Description: | Kevin Finisterre discovered that several integer overflows in the TIFF library could lead to the execution of arbitrary code. For the stable distribution, this problem has been fixed in version 3.8.2-11.3. For the unstable distribution, this problem has been fixed in version 3.9.4-1. We recommend that you upgrade your tiff packages. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2084-1 CVE-2010-1411 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 | Product(s): | tiff |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-10-03 | Name : Debian Security Advisory DSA 2552-1 (tiff) File : nvt/deb_2552_1.nasl |
2012-09-26 | Name : Gentoo Security Advisory GLSA 201209-02 (tiff) File : nvt/glsa_201209_02.nasl |
2011-08-09 | Name : CentOS Update for libtiff CESA-2010:0519 centos5 i386 File : nvt/gb_CESA-2010_0519_libtiff_centos5_i386.nasl |
2011-05-06 | Name : Fedora Update for mingw32-libtiff FEDORA-2011-5955 File : nvt/gb_fedora_2011_5955_mingw32-libtiff_fc13.nasl |
2011-04-19 | Name : Fedora Update for libtiff FEDORA-2011-3827 File : nvt/gb_fedora_2011_3827_libtiff_fc13.nasl |
2011-03-24 | Name : Ubuntu Update for tiff regression USN-1085-2 File : nvt/gb_ubuntu_USN_1085_2.nasl |
2011-03-15 | Name : Ubuntu Update for tiff vulnerabilities USN-1085-1 File : nvt/gb_ubuntu_USN_1085_1.nasl |
2010-08-21 | Name : Debian Security Advisory DSA 2084-1 (tiff) File : nvt/deb_2084_1.nasl |
2010-08-20 | Name : CentOS Update for libtiff CESA-2010:0520 centos3 i386 File : nvt/gb_CESA-2010_0520_libtiff_centos3_i386.nasl |
2010-08-09 | Name : Mandriva Update for libtiff MDVSA-2010:146 (libtiff) File : nvt/gb_mandriva_MDVSA_2010_146.nasl |
2010-08-09 | Name : Mandriva Update for libtiff MDVSA-2010:145 (libtiff) File : nvt/gb_mandriva_MDVSA_2010_145.nasl |
2010-07-12 | Name : Fedora Update for mingw32-libtiff FEDORA-2010-10460 File : nvt/gb_fedora_2010_10460_mingw32-libtiff_fc13.nasl |
2010-07-12 | Name : Fedora Update for mingw32-libtiff FEDORA-2010-10469 File : nvt/gb_fedora_2010_10469_mingw32-libtiff_fc12.nasl |
2010-07-12 | Name : RedHat Update for libtiff RHSA-2010:0520-01 File : nvt/gb_RHSA-2010_0520-01_libtiff.nasl |
2010-07-12 | Name : RedHat Update for libtiff RHSA-2010:0519-01 File : nvt/gb_RHSA-2010_0519-01_libtiff.nasl |
2010-07-06 | Name : Fedora Update for libtiff FEDORA-2010-10333 File : nvt/gb_fedora_2010_10333_libtiff_fc12.nasl |
2010-07-06 | Name : FreeBSD Ports: tiff File : nvt/freebsd_tiff6.nasl |
2010-07-02 | Name : Fedora Update for libtiff FEDORA-2010-10334 File : nvt/gb_fedora_2010_10334_libtiff_fc13.nasl |
2010-06-25 | Name : Fedora Update for libtiff FEDORA-2010-10359 File : nvt/gb_fedora_2010_10359_libtiff_fc11.nasl |
2010-06-25 | Name : Ubuntu Update for tiff vulnerabilities USN-954-1 File : nvt/gb_ubuntu_USN_954_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2010-180-02 libtiff File : nvt/esoft_slk_ssa_2010_180_02.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
66084 | LibTIFF TIFFRGBAImageGet Function Invalid SamplesPerPixel / Photometric Combi... |
66082 | LibTIFF TIFFExtractData Macro Crafted TIFF File Directory Entry Unknown Tag T... |
65971 | LibTIFF tif_strip.c TIFFVStripSize Function Downsampled OJPEG Input DoS |
65969 | LibTIFF TIFFYCbCrtoRGB Function Downsampled OJPEG Input ReferenceBlackWhite V... |
65296 | Apple Safari ImageIO TIFF File Handling Multiple Overflows |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0520.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0519.nasl - Type : ACT_GATHER_INFO |
2012-09-27 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2552.nasl - Type : ACT_GATHER_INFO |
2012-09-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-02.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100708_libtiff_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2011-08-11 | Name : The remote Windows host has an application that is affected by multiple vulne... File : blackberry_es_png_kb27244.nasl - Type : ACT_GATHER_INFO |
2011-03-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1085-2.nasl - Type : ACT_GATHER_INFO |
2011-03-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1085-1.nasl - Type : ACT_GATHER_INFO |
2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-7052.nasl - Type : ACT_GATHER_INFO |
2010-08-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0520.nasl - Type : ACT_GATHER_INFO |
2010-08-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-146.nasl - Type : ACT_GATHER_INFO |
2010-08-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-145.nasl - Type : ACT_GATHER_INFO |
2010-08-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2084.nasl - Type : ACT_GATHER_INFO |
2010-07-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0520.nasl - Type : ACT_GATHER_INFO |
2010-07-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0519.nasl - Type : ACT_GATHER_INFO |
2010-07-16 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0519.nasl - Type : ACT_GATHER_INFO |
2010-07-07 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10469.nasl - Type : ACT_GATHER_INFO |
2010-07-07 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10460.nasl - Type : ACT_GATHER_INFO |
2010-07-06 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10333.nasl - Type : ACT_GATHER_INFO |
2010-07-02 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10334.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2010-180-02.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10359.nasl - Type : ACT_GATHER_INFO |
2010-06-22 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-954-1.nasl - Type : ACT_GATHER_INFO |
2010-06-17 | Name : The remote host contains a multimedia application that has multiple vulnerabi... File : itunes_9_2_banner.nasl - Type : ACT_GATHER_INFO |
2010-06-17 | Name : The remote host contains an application that is affected by multiple vulnerab... File : itunes_9_2.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2010-004.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12618.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libtiff-devel-100525.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_libtiff-devel-100524.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_libtiff-devel-100525.nasl - Type : ACT_GATHER_INFO |
2010-06-15 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_4.nasl - Type : ACT_GATHER_INFO |
2010-06-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_313da7dc763b11dfbcce0018f3e2eb82.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:53:36 |
|