9.3 - MDVSA-2009:169-1

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	MDVSA-2009:169-1	First vendor Publication	2009-12-03
Vendor	Mandriva	Last vendor Modification	2009-12-03
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been found and corrected in libtiff:

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327 (CVE-2009-2285).

Fix several places in tiff2rgba and rgb2ycbcr that were being careless about possible integer overflow in calculation of buffer sizes (CVE-2009-2347).

This update provides fixes for these vulnerabilities.

Update:

Packages for 2008.0 are being provided due to extended support for Corporate products.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:169-1

CWE : Common Weakness Enumeration

%	Id	Name
67 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
33 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10145

Oval ID:	oval:org.mitre.oval:def:10145
Title:	Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
Description:	Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2285	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section libtiff is earlier than 0:3.5.7-33.el3 AND libtiff-devel is earlier than 0:3.5.7-33.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section libtiff is earlier than 0:3.6.1-12.el4_8.4 AND libtiff-devel is earlier than 0:3.6.1-12.el4_8.4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section libtiff is earlier than 0:3.8.2-7.el5_3.4 AND libtiff-devel is earlier than 0:3.8.2-7.el5_3.4

Definition Id: oval:org.mitre.oval:def:10988

Oval ID:	oval:org.mitre.oval:def:10988
Title:	Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Description:	Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2347	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section libtiff is earlier than 0:3.5.7-33.el3 AND libtiff-devel is earlier than 0:3.5.7-33.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section libtiff is earlier than 0:3.6.1-12.el4_8.4 AND libtiff-devel is earlier than 0:3.6.1-12.el4_8.4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section libtiff is earlier than 0:3.8.2-7.el5_3.4 AND libtiff-devel is earlier than 0:3.8.2-7.el5_3.4

Definition Id: oval:org.mitre.oval:def:11489

Oval ID:	oval:org.mitre.oval:def:11489
Title:	Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
Description:	Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2327	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section libtiff is earlier than 0:3.5.7-31.el3 AND libtiff-devel is earlier than 0:3.5.7-31.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section libtiff is earlier than 0:3.6.1-12.el4_7.2 AND libtiff-devel is earlier than 0:3.6.1-12.el4_7.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section libtiff is earlier than 0:3.8.2-7.el5_2.2 AND libtiff-devel is earlier than 0:3.8.2-7.el5_2.2

Definition Id: oval:org.mitre.oval:def:12926

Oval ID:	oval:org.mitre.oval:def:12926
Title:	USN-801-1 -- tiff vulnerability
Description:	Tielei Wang and Tom Lane discovered that the TIFF library did not correctly handle certain malformed TIFF images. If a user or automated system were tricked into processing a malicious image, an attacker could execute arbitrary code with the privileges of the user invoking the program.
Family:	unix	Class:	patch
Reference(s):	USN-801-1 CVE-2009-2347	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	tiff
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libtiff4 DPKG is earlier than 3.8.2-7ubuntu3.4 AND libtiff-opengl DPKG is earlier than 3.8.2-7ubuntu3.4 AND libtiffxx0c2 DPKG is earlier than 3.8.2-7ubuntu3.4 AND libtiff-tools DPKG is earlier than 3.8.2-7ubuntu3.4 AND libtiff4-dev DPKG is earlier than 3.8.2-7ubuntu3.4 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libtiff4 DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 AND libtiff-opengl DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 AND libtiffxx0c2 DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 AND libtiff-tools DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 AND libtiff4-dev DPKG is earlier than 3.8.2-11ubuntu0.9.04.3 OR Release section Ubuntu 6.06 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libtiff4 DPKG is earlier than 3.7.4-1ubuntu3.6 AND libtiff-opengl DPKG is earlier than 3.7.4-1ubuntu3.6 AND libtiffxx0c2 DPKG is earlier than 3.7.4-1ubuntu3.6 AND libtiff-tools DPKG is earlier than 3.7.4-1ubuntu3.6 AND libtiff4-dev DPKG is earlier than 3.7.4-1ubuntu3.6 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc DPKG is earlier than 3.8.2-11ubuntu0.8.10.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libtiff4 DPKG is earlier than 3.8.2-11ubuntu0.8.10.3 AND libtiff-opengl DPKG is earlier than 3.8.2-11ubuntu0.8.10.3 AND libtiffxx0c2 DPKG is earlier than 3.8.2-11ubuntu0.8.10.3 AND libtiff-tools DPKG is earlier than 3.8.2-11ubuntu0.8.10.3 AND libtiff4-dev DPKG is earlier than 3.8.2-11ubuntu0.8.10.3

Definition Id: oval:org.mitre.oval:def:13570

Oval ID:	oval:org.mitre.oval:def:13570
Title:	USN-797-1 -- tiff vulnerability
Description:	It was discovered that the TIFF library did not correctly handle certain malformed TIFF images. If a user or automated system were tricked into processing a malicious image, a remote attacker could cause an application linked against libtiff to crash, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-797-1 CVE-2009-2285	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	tiff
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libtiff4 DPKG is earlier than 3.8.2-7ubuntu3.2 AND libtiff-opengl DPKG is earlier than 3.8.2-7ubuntu3.2 AND libtiffxx0c2 DPKG is earlier than 3.8.2-7ubuntu3.2 AND libtiff-tools DPKG is earlier than 3.8.2-7ubuntu3.2 AND libtiff4-dev DPKG is earlier than 3.8.2-7ubuntu3.2 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libtiff4 DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 AND libtiff-opengl DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 AND libtiffxx0c2 DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 AND libtiff-tools DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 AND libtiff4-dev DPKG is earlier than 3.8.2-11ubuntu0.9.04.1 OR Release section Ubuntu 6.06 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libtiff4 DPKG is earlier than 3.7.4-1ubuntu3.4 AND libtiff-opengl DPKG is earlier than 3.7.4-1ubuntu3.4 AND libtiffxx0c2 DPKG is earlier than 3.7.4-1ubuntu3.4 AND libtiff-tools DPKG is earlier than 3.7.4-1ubuntu3.4 AND libtiff4-dev DPKG is earlier than 3.7.4-1ubuntu3.4 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc DPKG is earlier than 3.8.2-11ubuntu0.8.10.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libtiff4 DPKG is earlier than 3.8.2-11ubuntu0.8.10.1 AND libtiff-opengl DPKG is earlier than 3.8.2-11ubuntu0.8.10.1 AND libtiffxx0c2 DPKG is earlier than 3.8.2-11ubuntu0.8.10.1 AND libtiff-tools DPKG is earlier than 3.8.2-11ubuntu0.8.10.1 AND libtiff4-dev DPKG is earlier than 3.8.2-11ubuntu0.8.10.1

Definition Id: oval:org.mitre.oval:def:13644

Oval ID:	oval:org.mitre.oval:def:13644
Title:	DSA-1835-1 tiff -- several
Description:	Several vulnerabilities have been discovered in the library for the Tag Image File Format. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2285 It was discovered that malformed TIFF images can lead to a crash in the decompression code, resulting in denial of service. CVE-2009-2347 Andrea Barisani discovered several integer overflows, which can lead to the execution of arbitrary code if malformed images are passed to the rgb2ycbcr or tiff2rgba tools. For the old stable distribution, these problems have been fixed in version 3.8.2-7+etch3. For the stable distribution, these problems have been fixed in version 3.8.2-11.2. For the unstable distribution, these problems will be fixed soon. We recommend that you upgrade your tiff packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1835-1 CVE-2009-2285 CVE-2009-2347	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	tiff
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc DPKG is earlier than 3.8.2-11.2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libtiff4 DPKG is earlier than 3.8.2-11.2 AND libtiff-opengl DPKG is earlier than 3.8.2-11.2 AND libtiff-tools DPKG is earlier than 3.8.2-11.2 AND libtiffxx0c2 DPKG is earlier than 3.8.2-11.2 AND libtiff4-dev DPKG is earlier than 3.8.2-11.2 OR Release section Debian GNU/Linux 4.0 is installed. AND Packages section libtiff4 DPKG is earlier than 3.8.2-7+etch3 AND libtiff-opengl DPKG is earlier than 3.8.2-7+etch3 AND libtiffxx0c2 DPKG is earlier than 3.8.2-7+etch3 AND libtiff-tools DPKG is earlier than 3.8.2-7+etch3 AND libtiff4-dev DPKG is earlier than 3.8.2-7+etch3

Definition Id: oval:org.mitre.oval:def:17803

Oval ID:	oval:org.mitre.oval:def:17803
Title:	USN-639-1 -- tiff vulnerability
Description:	Drew Yao discovered that the TIFF library did not correctly validate LZW compressed TIFF images.
Family:	unix	Class:	patch
Reference(s):	USN-639-1 CVE-2008-2327	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04	Product(s):	tiff
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND libtiff4 DPKG is earlier than 3.7.4-1ubuntu3.3 AND Release section Ubuntu 7.04 is installed AND libtiff4 DPKG is earlier than 3.8.2-6ubuntu1 AND Release section Ubuntu 7.10 is installed AND libtiff4 DPKG is earlier than 3.8.2-7ubuntu2.1 AND Release section Ubuntu 8.04 is installed AND libtiff4 DPKG is earlier than 3.8.2-7ubuntu3.1

Definition Id: oval:org.mitre.oval:def:18179

Oval ID:	oval:org.mitre.oval:def:18179
Title:	DSA-1632-1 tiff - arbitrary code execution
Description:	Drew Yao discovered that libTIFF, a library for handling the Tagged Image File Format, is vulnerable to a programming error allowing malformed tiff files to lead to a crash or execution of arbitrary code.
Family:	unix	Class:	patch
Reference(s):	DSA-1632-1 CVE-2008-2327	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	tiff
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND tiff DPKG is earlier than 3.8.2-7+etch1

Definition Id: oval:org.mitre.oval:def:22496

Oval ID:	oval:org.mitre.oval:def:22496
Title:	ELSA-2008:0847: libtiff security and bug fix update (Important)
Description:	Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
Family:	unix	Class:	patch
Reference(s):	ELSA-2008:0847-01 CVE-2008-2327	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	libtiff
Definition Synopsis:
Oracle Linux 5.x rpm test libtiff is earlier than 0:3.8.2-7.el5_2.2 AND libtiff-devel is earlier than 0:3.8.2-7.el5_2.2

Definition Id: oval:org.mitre.oval:def:22533

Oval ID:	oval:org.mitre.oval:def:22533
Title:	ELSA-2009:1159: libtiff security update (Moderate)
Description:	Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:1159-01 CVE-2009-2285 CVE-2009-2347	Version:	13
Platform(s):	Oracle Linux 5	Product(s):	libtiff
Definition Synopsis:
Oracle Linux 5.x rpm test libtiff is earlier than 0:3.8.2-7.el5_3.4 AND libtiff-devel is earlier than 0:3.8.2-7.el5_3.4

Definition Id: oval:org.mitre.oval:def:28879

Oval ID:	oval:org.mitre.oval:def:28879
Title:	RHSA-2009:1159 -- libtiff security update (Moderate)
Description:	Updated libtiff packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:1159 CESA-2009:1159-CentOS 3 CESA-2009:1159-CentOS 5 CVE-2009-2285 CVE-2009-2347	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 3 CentOS Linux 5	Product(s):	libtiff
Definition Synopsis:
Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section libtiff-devel is earlier than 0:3.8.2-7.el5_3.4 AND libtiff is earlier than 0:3.8.2-7.el5_3.4 AND Red Hat Enterprise Linux 3 release section The operating system installed on the system is Red Hat Enterprise Linux 3 Packages match section libtiff is earlier than 0:3.5.7-33.el3 AND libtiff-devel is earlier than 0:3.5.7-33.el3 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section libtiff is earlier than 0:3.6.1-12.el4_8.4 AND libtiff-devel is earlier than 0:3.6.1-12.el4_8.4

Definition Id: oval:org.mitre.oval:def:28973

Oval ID:	oval:org.mitre.oval:def:28973
Title:	RHSA-2008:0847 -- libtiff security and bug fix update (Important)
Description:	Updated libtiff packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)
Family:	unix	Class:	patch
Reference(s):	RHSA-2008:0847 CESA-2008:0847-CentOS 5 CVE-2008-2327	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	libtiff
Definition Synopsis:
Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section libtiff-devel is earlier than 0:3.8.2-7.el5_2.2 AND libtiff is earlier than 0:3.8.2-7.el5_2.2

Definition Id: oval:org.mitre.oval:def:5514

Oval ID:	oval:org.mitre.oval:def:5514
Title:	LibTIFF Buffer Underflow in Decoding LZW Data Lets Remote Users Execute Arbitrary Code
Description:	Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2327	Version:	3
Platform(s):	VMWare ESX Server 3 VMWare ESX Server 3.5	Product(s):
Definition Synopsis:
IF VMWare ESX Server 3.0.3 is installed AND Patch ESX303-200810503-SG is not installed OR VMWare ESX Server 3.0.2 is installed AND Patch ESX-1006968 is not installed OR VMware ESX Server 3.5.0 is installed AND Patch ESX350-200811405-SG is not installed

Definition Id: oval:org.mitre.oval:def:7049

Oval ID:	oval:org.mitre.oval:def:7049
Title:	LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
Description:	Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2009-2285	Version:	17
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Apple Safari Apple iTunes
Definition Synopsis:
Check iTunes Apple iTunes is installed AND iTunes.exe version is less than 9.1.0.79 OR Check Safari Apple Safari is installed AND Apple Safari version is less than 5.31.22.7

Definition Id: oval:org.mitre.oval:def:7522

Oval ID:	oval:org.mitre.oval:def:7522
Title:	DSA-1835 tiff -- several vulnerabilities
Description:	Several vulnerabilities have been discovered in the library for the Tag Image File Format (TIFF). The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that malformed TIFF images can lead to a crash in the decompression code, resulting in denial of service. Andrea Barisani discovered several integer overflows, which can lead to the execution of arbitrary code if malformed images are passed to the rgb2ycbcr or tiff2rgba tools.
Family:	unix	Class:	patch
Reference(s):	DSA-1835 CVE-2009-2285 CVE-2009-2347	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	tiff
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND libtiff-doc is earlier than 3.8.2-11.2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libtiff4 is earlier than 3.8.2-11.2 AND libtiff-opengl is earlier than 3.8.2-11.2 AND libtiff-tools is earlier than 3.8.2-11.2 AND libtiffxx0c2 is earlier than 3.8.2-11.2 AND libtiff4-dev is earlier than 3.8.2-11.2 OR Release section Debian GNU/Linux 4.0 is installed. AND Packages section libtiff4 is earlier than 3.8.2-7+etch3 AND libtiff-opengl is earlier than 3.8.2-7+etch3 AND libtiffxx0c2 is earlier than 3.8.2-7+etch3 AND libtiff-tools is earlier than 3.8.2-7+etch3 AND libtiff4-dev is earlier than 3.8.2-7+etch3

Definition Id: oval:org.mitre.oval:def:7619

Oval ID:	oval:org.mitre.oval:def:7619
Title:	DSA-1632 tiff -- buffer underflow
Description:	Drew Yao discovered that libTIFF, a library for handling the Tagged Image File Format, is vulnerable to a programming error allowing malformed tiff files to lead to a crash or execution of arbitrary code.
Family:	unix	Class:	patch
Reference(s):	DSA-1632 CVE-2008-2327	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	tiff
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is hppa Packages section libtiff4 is earlier than 3.8.2-7+etch1 AND libtiff-opengl is earlier than 3.8.2-7+etch1 AND libtiffxx0c2 is earlier than 3.8.2-7+etch1 AND libtiff-tools is earlier than 3.8.2-7+etch1 AND libtiff4-dev is earlier than 3.8.2-7+etch1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Libtiff cpe:2.3:a:libtiff:libtiff:4.0:::::::* cpe:2.3:a:libtiff:libtiff:3.9:::::::* cpe:2.3:a:libtiff:libtiff:3.8.2:::::::* cpe:2.3:a:libtiff:libtiff:3.8.1:::::::* cpe:2.3:a:libtiff:libtiff:3.8.0:::::::* cpe:2.3:a:libtiff:libtiff:3.7.4:::::::* cpe:2.3:a:libtiff:libtiff:3.7.3:::::::* cpe:2.3:a:libtiff:libtiff:3.7.2:::::::* cpe:2.3:a:libtiff:libtiff:3.7.1:::::::* cpe:2.3:a:libtiff:libtiff:3.7.0:alpha:::::: cpe:2.3:a:libtiff:libtiff:3.7.0:beta:::::: cpe:2.3:a:libtiff:libtiff:3.7.0:::::::* cpe:2.3:a:libtiff:libtiff:3.7.0:beta2:::::: cpe:2.3:a:libtiff:libtiff:3.6.1:::::::* cpe:2.3:a:libtiff:libtiff:3.6.0:beta:::::: cpe:2.3:a:libtiff:libtiff:3.6.0:::::::* cpe:2.3:a:libtiff:libtiff:3.6.0:beta2:::::: cpe:2.3:a:libtiff:libtiff:3.5.7:alpha4:::::: cpe:2.3:a:libtiff:libtiff:3.5.7:alpha3:::::: cpe:2.3:a:libtiff:libtiff:3.5.7:::::::* cpe:2.3:a:libtiff:libtiff:3.5.7:alpha2:::::: cpe:2.3:a:libtiff:libtiff:3.5.7:beta:::::: cpe:2.3:a:libtiff:libtiff:3.5.7:alpha:::::: cpe:2.3:a:libtiff:libtiff:3.5.6:::::::* cpe:2.3:a:libtiff:libtiff:3.5.6:beta:::::: cpe:2.3:a:libtiff:libtiff:3.5.5:::::::* cpe:2.3:a:libtiff:libtiff:3.5.4:::::::* cpe:2.3:a:libtiff:libtiff:3.5.3:::::::* cpe:2.3:a:libtiff:libtiff:3.5.2:::::::* cpe:2.3:a:libtiff:libtiff:3.5.1:::::::* cpe:2.3:a:libtiff:libtiff:3.4:beta32:::::: cpe:2.3:a:libtiff:libtiff:3.4:::::::* cpe:2.3:a:libtiff:libtiff:3.4:beta36:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta28:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta34:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta35:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta18:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta24:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta29:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta37:::::: cpe:2.3:a:libtiff:libtiff:3.4:beta31:::::: cpe:2.3:a:libtiff:libtiff:::::::: cpe:2.3:a:libtiff:libtiff:-:::::::*	43

OpenVAS Exploits

Date	Description
2012-09-26	Name : Gentoo Security Advisory GLSA 201209-02 (tiff) File : nvt/glsa_201209_02.nasl
2011-08-09	Name : CentOS Update for libtiff CESA-2009:1159 centos5 i386 File : nvt/gb_CESA-2009_1159_libtiff_centos5_i386.nasl
2011-08-09	Name : CentOS Update for libtiff CESA-2009:1159 centos3 i386 File : nvt/gb_CESA-2009_1159_libtiff_centos3_i386.nasl
2011-03-15	Name : Mandriva Update for libtiff MDVSA-2011:043 (libtiff) File : nvt/gb_mandriva_MDVSA_2011_043.nasl
2010-07-06	Name : FreeBSD Ports: tiff File : nvt/freebsd_tiff5.nasl
2010-06-25	Name : Fedora Update for libtiff FEDORA-2010-10359 File : nvt/gb_fedora_2010_10359_libtiff_fc11.nasl
2010-05-12	Name : Mac OS X 10.6.2 Update / Mac OS X Security Update 2009-006 File : nvt/macosx_upd_10_6_2_secupd_2009-006.nasl
2010-05-12	Name : Mac OS X 10.5.5 Update / Security Update 2008-006 File : nvt/macosx_upd_10_5_5_secupd_2008-006.nasl
2010-04-06	Name : Mac OS X Security Update 2010-001 File : nvt/macosx_secupd_2010-001.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:169-1 (libtiff) File : nvt/mdksa_2009_169_1.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : Solaris Update for GNOME 2.6.0 119900-09 File : nvt/gb_solaris_119900_09.nasl
2009-10-13	Name : SLES10: Security update for libtiff File : nvt/sles10_libtiff.nasl
2009-10-13	Name : SLES10: Security update for libtiff File : nvt/sles10_libtiff0.nasl
2009-10-13	Name : SLES10: Security update for libtiff File : nvt/sles10_libtiff1.nasl
2009-10-13	Name : Solaris Update for Gnome libtiff - library for reading and writing TIFF 11990... File : nvt/gb_solaris_119901_08.nasl
2009-10-11	Name : SLES11: Security update for libtiff File : nvt/sles11_libtiff30.nasl
2009-10-11	Name : SLES11: Security update for libtiff3 File : nvt/sles11_libtiff3.nasl
2009-10-10	Name : SLES9: Security update for libtiff File : nvt/sles9p5055840.nasl
2009-10-10	Name : SLES9: Security update for libtiff File : nvt/sles9p5055047.nasl
2009-10-10	Name : SLES9: Security update for libtiff File : nvt/sles9p5034140.nasl
2009-09-09	Name : SuSE Security Summary SUSE-SR:2009:014 File : nvt/suse_sr_2009_014.nasl
2009-08-17	Name : SuSE Security Summary SUSE-SR:2009:013 File : nvt/suse_sr_2009_013.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:169 (libtiff) File : nvt/mdksa_2009_169.nasl
2009-08-17	Name : Gentoo Security Advisory GLSA 200908-03 (tiff) File : nvt/glsa_200908_03.nasl
2009-07-29	Name : Mandrake Security Advisory MDVSA-2009:150 (libtiff) File : nvt/mdksa_2009_150.nasl
2009-07-29	Name : CentOS Security Advisory CESA-2009:1159 (libtiff) File : nvt/ovcesa2009_1159.nasl
2009-07-29	Name : Ubuntu USN-802-1 (apache2) File : nvt/ubuntu_802_1.nasl
2009-07-29	Name : RedHat Security Advisory RHSA-2009:1159 File : nvt/RHSA_2009_1159.nasl
2009-07-29	Name : Ubuntu USN-799-1 (dbus) File : nvt/ubuntu_799_1.nasl
2009-07-29	Name : Ubuntu USN-801-1 (tiff) File : nvt/ubuntu_801_1.nasl
2009-07-29	Name : Fedora Core 11 FEDORA-2009-7775 (libtiff) File : nvt/fcore_2009_7775.nasl
2009-07-29	Name : Fedora Core 10 FEDORA-2009-7724 (libtiff) File : nvt/fcore_2009_7724.nasl
2009-07-29	Name : Fedora Core 10 FEDORA-2009-7717 (mingw32-libtiff) File : nvt/fcore_2009_7717.nasl
2009-07-29	Name : Debian Security Advisory DSA 1835-1 (tiff) File : nvt/deb_1835_1.nasl
2009-07-15	Name : Ubuntu USN-797-1 (tiff) File : nvt/ubuntu_797_1.nasl
2009-07-07	Name : LibTIFF TIFF Image Buffer Underflow Vulnerability File : nvt/gb_libtiff_buf_vuln.nasl
2009-07-06	Name : Fedora Core 11 FEDORA-2009-7417 (libtiff) File : nvt/fcore_2009_7417.nasl
2009-07-06	Name : Fedora Core 10 FEDORA-2009-7358 (libtiff) File : nvt/fcore_2009_7358.nasl
2009-07-06	Name : Fedora Core 9 FEDORA-2009-7335 (libtiff) File : nvt/fcore_2009_7335.nasl
2009-04-09	Name : Mandriva Update for libtiff MDVSA-2008:184 (libtiff) File : nvt/gb_mandriva_MDVSA_2008_184.nasl
2009-03-23	Name : Ubuntu Update for tiff vulnerability USN-639-1 File : nvt/gb_ubuntu_USN_639_1.nasl
2009-03-06	Name : RedHat Update for libtiff RHSA-2008:0863-01 File : nvt/gb_RHSA-2008_0863-01_libtiff.nasl
2009-03-06	Name : RedHat Update for libtiff RHSA-2008:0848-01 File : nvt/gb_RHSA-2008_0848-01_libtiff.nasl
2009-03-06	Name : RedHat Update for libtiff RHSA-2008:0847-01 File : nvt/gb_RHSA-2008_0847-01_libtiff.nasl
2009-02-27	Name : CentOS Update for libtiff CESA-2008:0863 centos3 x86_64 File : nvt/gb_CESA-2008_0863_libtiff_centos3_x86_64.nasl
2009-02-27	Name : CentOS Update for libtiff CESA-2008:0863 centos3 i386 File : nvt/gb_CESA-2008_0863_libtiff_centos3_i386.nasl
2009-02-27	Name : CentOS Update for libtiff CESA-2008:0863-01 centos2 i386 File : nvt/gb_CESA-2008_0863-01_libtiff_centos2_i386.nasl
2009-02-17	Name : Fedora Update for libtiff FEDORA-2008-7388 File : nvt/gb_fedora_2008_7388_libtiff_fc8.nasl
2009-02-17	Name : Fedora Update for libtiff FEDORA-2008-7370 File : nvt/gb_fedora_2008_7370_libtiff_fc9.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200809-07 (tiff) File : nvt/glsa_200809_07.nasl
2008-09-17	Name : Debian Security Advisory DSA 1632-1 (tiff) File : nvt/deb_1632_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
55822	LibTIFF tiff2rgba Utility cvt_whole_image() Function Crafted TIFF File Handli...
55821	LibTIFF rgb2ycbcr Utility tiffcvt() Function Crafted TIFF File Handling Overflow
55265	LibTIFF libtiff/tif_lzw.c LZWDecodeCompat() Function TIFF File Handling Under...
47795	LibTIFF LZW Decoder libtiff/tif_lzw.c Multiple Function TIFF Decoder Underflow

Information Assurance Vulnerability Management (IAVM)

Date	Description
2008-11-06	IAVM : 2008-B-0078 - Multiple Vulnerabilities in VMware Severity : Category I - VMSKEY : V0017874

Nessus® Vulnerability Scanner

Date	Description
2014-11-26	Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2009-0027.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0848.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1159.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0863.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0847.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0848.nasl - Type : ACT_GATHER_INFO
2013-04-11	Name : The remote Mac OS X host contains a photo organization application that is af... File : macosx_picasa_3_9_14_34.nasl - Type : ACT_GATHER_INFO
2013-04-11	Name : The photo organizer running on the remote Windows host has multiple vulnerabi... File : google_picasa_3_9_136_17.nasl - Type : ACT_GATHER_INFO
2012-09-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-02.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090728_libtiff_for_SL3_0_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080828_libtiff_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2011-03-09	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-043.nasl - Type : ACT_GATHER_INFO
2010-06-17	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8816bf3a792911dfbcce0018f3e2eb82.nasl - Type : ACT_GATHER_INFO
2010-03-31	Name : The remote host contains a multimedia application that has multiple vulnerabi... File : itunes_9_1_banner.nasl - Type : ACT_GATHER_INFO
2010-03-31	Name : The remote host contains an application that is affected by multiple vulnerab... File : itunes_9_1.nasl - Type : ACT_GATHER_INFO
2010-03-11	Name : The remote host contains a web browser that is affected by several vulnerabil... File : safari_4_0_5.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1835.nasl - Type : ACT_GATHER_INFO
2010-01-20	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2010-001.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0847.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-169.nasl - Type : ACT_GATHER_INFO
2009-11-09	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_2.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_libtiff-devel-6406.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_libtiff3-6340.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libtiff-devel-090807.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12470.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12448.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12229.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libtiff3-090703.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-6337.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-6407.nasl - Type : ACT_GATHER_INFO
2009-08-20	Name : The remote openSUSE host is missing a security update. File : suse_11_1_libtiff-devel-090807.nasl - Type : ACT_GATHER_INFO
2009-08-20	Name : The remote openSUSE host is missing a security update. File : suse_11_0_libtiff-devel-090807.nasl - Type : ACT_GATHER_INFO
2009-08-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200908-03.nasl - Type : ACT_GATHER_INFO
2009-08-06	Name : The remote openSUSE host is missing a security update. File : suse_11_1_libtiff3-090703.nasl - Type : ACT_GATHER_INFO
2009-08-06	Name : The remote openSUSE host is missing a security update. File : suse_11_0_libtiff3-090703.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2008-0017.nasl - Type : ACT_GATHER_INFO
2009-07-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1159.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_libtiff-080820.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Fedora host is missing a security update. File : fedora_2009-7724.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Fedora host is missing a security update. File : fedora_2009-7775.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-7763.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Fedora host is missing a security update. File : fedora_2009-7717.nasl - Type : ACT_GATHER_INFO
2009-07-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1159.nasl - Type : ACT_GATHER_INFO
2009-07-14	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-150.nasl - Type : ACT_GATHER_INFO
2009-07-14	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-801-1.nasl - Type : ACT_GATHER_INFO
2009-07-07	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-797-1.nasl - Type : ACT_GATHER_INFO
2009-07-06	Name : The remote Fedora host is missing a security update. File : fedora_2009-7417.nasl - Type : ACT_GATHER_INFO
2009-07-06	Name : The remote Fedora host is missing a security update. File : fedora_2009-7358.nasl - Type : ACT_GATHER_INFO
2009-07-06	Name : The remote Fedora host is missing a security update. File : fedora_2009-7335.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-184.nasl - Type : ACT_GATHER_INFO
2008-11-14	Name : The remote host contains a web browser that is affected by several issues. File : safari_3_2.nasl - Type : ACT_GATHER_INFO
2008-11-14	Name : The remote host contains a web browser that is affected by several issues. File : macosx_Safari3_2.nasl - Type : ACT_GATHER_INFO
2008-09-16	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-006.nasl - Type : ACT_GATHER_INFO
2008-09-16	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_5.nasl - Type : ACT_GATHER_INFO
2008-09-10	Name : The remote Fedora host is missing a security update. File : fedora_2008-7370.nasl - Type : ACT_GATHER_INFO
2008-09-10	Name : The remote Fedora host is missing a security update. File : fedora_2008-7388.nasl - Type : ACT_GATHER_INFO
2008-09-09	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200809-07.nasl - Type : ACT_GATHER_INFO
2008-09-03	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-5538.nasl - Type : ACT_GATHER_INFO
2008-09-03	Name : The remote openSUSE host is missing a security update. File : suse_libtiff-5540.nasl - Type : ACT_GATHER_INFO
2008-09-03	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-639-1.nasl - Type : ACT_GATHER_INFO
2008-08-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0863.nasl - Type : ACT_GATHER_INFO
2008-08-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0848.nasl - Type : ACT_GATHER_INFO
2008-08-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0847.nasl - Type : ACT_GATHER_INFO
2008-08-30	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0863.nasl - Type : ACT_GATHER_INFO
2008-08-27	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1632.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 119901-17 File : solaris10_x86_119901.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 119900-18 File : solaris10_119900.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:40:28	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	16
CPE ID(s)	43
osvdb(s)	4
Openvas Exploit(s)	52
IAVM(s)	1
Nessus® Exploit(s)	67

	Related
9.3	MDVSA-2009:169
9.3	CVE-2009-2347
6.8	CVE-2008-2327
4.3	CVE-2009-2285
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)