Executive Summary

Informations
Name MDVSA-2012:184 First vendor Publication 2012-12-27
Vendor Mandriva Last vendor Modification 2012-12-27
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability was found and corrected in libtiff:

A stack-based buffer overflow was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code (CVE-2012-5581).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:184

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18058
 
Oval ID: oval:org.mitre.oval:def:18058
Title: DSA-2589-1 tiff - buffer overflow
Description: The tiff library for handling TIFF image files contained a stack-based buffer overflow, potentially allowing attackers who can submit such files to a vulnerable system to execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2589-1
CVE-2012-5581
 Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): tiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18117
 
Oval ID: oval:org.mitre.oval:def:18117
Title: USN-1655-1 -- tiff vulnerability
Description: Programs that use LibTIFF could be made to crash or run programs if they opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1655-1
CVE-2012-5581
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Ubuntu 8.04
 Product(s): tiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21373
 
Oval ID: oval:org.mitre.oval:def:21373
Title: RHSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): RHSA-2012:1590-01
CESA-2012:1590
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 55
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22764
 
Oval ID: oval:org.mitre.oval:def:22764
Title: DEPRECATED: ELSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): ELSA-2012:1590-01
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 22
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23936
 
Oval ID: oval:org.mitre.oval:def:23936
Title: ELSA-2012:1590: libtiff security update (Moderate)
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
Family: unix Class: patch
Reference(s): ELSA-2012:1590-01
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 21
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27430
 
Oval ID: oval:org.mitre.oval:def:27430
Title: DEPRECATED: ELSA-2012-1590 -- libtiff security update (moderate)
Description: [3.9.4-9] - Still more fixes to make test case for CVE-2012-5581 work on all platforms Resolves: #885310 [3.9.4-8] - Fix incomplete patch for CVE-2012-3401 - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works with pre-4.0.2 libtiff Resolves: #885310 [3.9.4-7] - Add fixes for CVE-2012-3401, CVE-2012-4447, CVE-2012-4564, CVE-2012-5581 Resolves: #885310
Family: unix Class: patch
Reference(s): ELSA-2012-1590
CVE-2012-3401
CVE-2012-4447
CVE-2012-4564
CVE-2012-5581
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libtiff
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 60

OpenVAS Exploits

Date Description
2013-09-18 Name : Debian Security Advisory DSA 2589-1 (tiff - buffer overflow)
File : nvt/deb_2589_1.nasl
2012-12-31 Name : Fedora Update for libtiff FEDORA-2012-20404
File : nvt/gb_fedora_2012_20404_libtiff_fc16.nasl
2012-12-31 Name : Fedora Update for libtiff FEDORA-2012-20446
File : nvt/gb_fedora_2012_20446_libtiff_fc17.nasl
2012-12-31 Name : Mandriva Update for libtiff MDVSA-2012:184 (libtiff)
File : nvt/gb_mandriva_MDVSA_2012_184.nasl
2012-12-26 Name : CentOS Update for libtiff CESA-2012:1590 centos5
File : nvt/gb_CESA-2012_1590_libtiff_centos5.nasl
2012-12-26 Name : CentOS Update for libtiff CESA-2012:1590 centos6
File : nvt/gb_CESA-2012_1590_libtiff_centos6.nasl
2012-12-26 Name : RedHat Update for libtiff RHSA-2012:1590-01
File : nvt/gb_RHSA-2012_1590-01_libtiff.nasl
2012-12-06 Name : Ubuntu Update for tiff USN-1655-1
File : nvt/gb_ubuntu_USN_1655_1.nasl

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_libtiff_20140617.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-29.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-147.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-046.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libtiff-8419.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libtiff-devel-130109.nasl - Type : ACT_GATHER_INFO
2013-01-14 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20348.nasl - Type : ACT_GATHER_INFO
2012-12-31 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20404.nasl - Type : ACT_GATHER_INFO
2012-12-31 Name : The remote Fedora host is missing a security update.
File : fedora_2012-20446.nasl - Type : ACT_GATHER_INFO
2012-12-28 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-184.nasl - Type : ACT_GATHER_INFO
2012-12-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2012-12-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20121218_libtiff_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-12-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1590.nasl - Type : ACT_GATHER_INFO
2012-12-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2589.nasl - Type : ACT_GATHER_INFO
2012-12-06 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1655-1.nasl - Type : ACT_GATHER_INFO
2006-11-06 Name : The remote host is missing Sun Security Patch number 119901-17
File : solaris10_x86_119901.nasl - Type : ACT_GATHER_INFO
2006-11-06 Name : The remote host is missing Sun Security Patch number 119900-18
File : solaris10_119900.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2014-02-17 11:43:16
  • Multiple Updates
2013-01-07 21:21:30
  • Multiple Updates
2013-01-05 13:22:48
  • Multiple Updates
2012-12-27 17:17:39
  • First insertion