Updated libtiff packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Several integer overflow flaws, leading to heap-based buffer overflows, were found in various libtiff color space conversion tools.
An attacker could create a specially crafted TIFF file, which once opened by an unsuspecting user, would cause the conversion tool to crash or, potentially, execute arbitrary code with the privileges of the user running the tool. (CVE-2009-2347)

A buffer underwrite flaw was found in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a specially crafted LZW-encoded TIFF file, which once opened by an unsuspecting user, would cause an application linked with libtiff to access an out-of-bounds memory location, leading to a denial of service (application crash). (CVE-2009-2285)

The CVE-2009-2347 flaws were discovered by Tielei Wang from ICST-ERCIS, Peking University.

All libtiff users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, all applications linked with the libtiff library (such as Konqueror) must be restarted for the update to take effect.

This update of the tiff package fixes various integer overflows in the tools. (CVE-2009-2347)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1159 advisory.

    - Fix buffer overrun risks caused by unchecked integer overflow (CVE-2009-2347)     Resolves: #507725
    - Fix some more LZW decoding vulnerabilities (CVE-2009-2285)     Resolves: #507725

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix buffer overrun risks caused by unchecked integer     overflow (CVE-2009-2347) Resolves: #507725

  - Fix some more LZW decoding vulnerabilities     (CVE-2009-2285) Resolves: #507725

  - Update upstream URL

  - Use -fno-strict-aliasing per rpmdiff recommendation

  - Fix LZW decoding vulnerabilities (CVE-2008-2327)     Resolves: #458812

  - Remove sgi2tiff.1 and tiffsv.1, since they are for     programs we don't ship Resolves: #460120

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-380:01 advisory.

    The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image     format files.  TIFF is a widely used file format for bitmapped images.  TIFF files usually end in the .tif     extension and they are often quite large.
    The libtiff package should be installed if you need to manipulate TIFF format image files.
    Fixed bugs:
    CVE-2009-2285     Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to     cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
    CVE-2009-2347     Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and     4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and     (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in     tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1159 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged     Image File Format (TIFF) files.

    Several integer overflow flaws, leading to heap-based buffer overflows,     were found in various libtiff color space conversion tools. An attacker     could create a specially-crafted TIFF file, which once opened by an     unsuspecting user, would cause the conversion tool to crash or,     potentially, execute arbitrary code with the privileges of the user running     the tool. (CVE-2009-2347)

    A buffer underwrite flaw was found in libtiff's Lempel-Ziv-Welch (LZW)     compression algorithm decoder. An attacker could create a specially-crafted     LZW-encoded TIFF file, which once opened by an unsuspecting user, would     cause an application linked with libtiff to access an out-of-bounds memory     location, leading to a denial of service (application crash).
    (CVE-2009-2285)

    The CVE-2009-2347 flaws were discovered by Tielei Wang from ICST-ERCIS,     Peking University.

    All libtiff users should upgrade to these updated packages, which contain     backported patches to correct these issues. After installing this update,     all applications linked with the libtiff library (such as Konqueror) must     be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

GNOME 2.6.0_x86: GNOME libtiff - library for reading and writing T.
Date this patch was last updated by Sun : Sep/15/16

GNOME 2.6.0: GNOME libtiff - library for reading and writing TIFF.
Date this patch was last updated by Sun : Nov/10/12

GNOME 2.6.0_x86: GNOME libtiff - library for reading and writing T.
Date this patch was last updated by Sun : Nov/10/12

Tielei Wang :

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

Multiple vulnerabilities has been found and corrected in libtiff :

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327 (CVE-2009-2285).

Fix several places in tiff2rgba and rgb2ycbcr that were being careless about possible integer overflow in calculation of buffer sizes (CVE-2009-2347).

This update provides fixes for these vulnerabilities.

Multiple vulnerabilities has been found and corrected in libtiff :

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327 (CVE-2009-2285).

Fix several places in tiff2rgba and rgb2ycbcr that were being careless about possible integer overflow in calculation of buffer sizes (CVE-2009-2347).

This update provides fixes for these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a     DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign     extended to an integer that produces more digits than expected in an sprintf call. (CVE-2006-2193)

  - Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-     dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG     stream that is longer than the scan line size (TiffScanLineSize). (CVE-2006-3460)

  - Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors. (CVE-2006-3461)

  - Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE     images. (CVE-2006-3462)

  - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short     when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial     of service via a large td_nstrips value, which triggers an infinite loop. (CVE-2006-3463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-2347 libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE) Not the same as last week's libtiff security issue ...

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2009-2285 libtiff: LZWDecodeCompat underflow

CVE-2009-2347 libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE)

Several integer overflow flaws, leading to heap-based buffer overflows, were found in various libtiff color space conversion tools.
An attacker could create a specially crafted TIFF file, which once opened by an unsuspecting user, would cause the conversion tool to crash or, potentially, execute arbitrary code with the privileges of the user running the tool. (CVE-2009-2347)

A buffer underwrite flaw was found in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a specially crafted LZW-encoded TIFF file, which once opened by an unsuspecting user, would cause an application linked with libtiff to access an out-of-bounds memory location, leading to a denial of service (application crash). (CVE-2009-2285)

The CVE-2009-2347 flaws were discovered by Tielei Wang from ICST-ERCIS, Peking University.

ID	名稱	產品	系列	已發布	已更新	嚴重性
40344	CentOS 3 / 5 : libtiff (CESA-2009:1159)	Nessus	CentOS Local Security Checks	2009/7/23	2021/1/4	high
40653	openSUSE Security Update : libtiff-devel (libtiff-devel-1176)	Nessus	SuSE Local Security Checks	2009/8/20	2021/1/14	high
67892	Oracle Linux 5 : libtiff (ELSA-2009-1159)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
79467	OracleVM 2.1 : libtiff (OVMSA-2009-0027)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/14	high
284232	MiracleLinux 3 : libtiff-3.8.2-7.4.1AXS3 (AXSA:2009-380:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
39850	RHEL 4 / 5 : libtiff (RHSA-2009:1159)	Nessus	Red Hat Local Security Checks	2009/7/17	2024/11/4	critical
107853	Solaris 10 (x86) : 119901-17	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
42018	openSUSE 10 Security Update : libtiff-devel (libtiff-devel-6406)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high
107348	Solaris 10 (sparc) : 119900-16	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
107851	Solaris 10 (x86) : 119901-15	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
47033	FreeBSD : tiff -- Multiple integer overflows (8816bf3a-7929-11df-bcce-0018f3e2eb82)	Nessus	FreeBSD Local Security Checks	2010/6/17	2021/1/6	high
39849	Mandriva Linux Security Advisory : libtiff (MDVSA-2009:150)	Nessus	Mandriva Local Security Checks	2009/7/14	2021/1/6	high
42991	Mandriva Linux Security Advisory : libtiff (MDVSA-2009:169-1)	Nessus	Mandriva Local Security Checks	2009/12/4	2021/1/6	high
206852	NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	high
39864	Fedora 11 : libtiff-3.8.2-14.fc11 (2009-7775)	Nessus	Fedora Local Security Checks	2009/7/20	2021/1/11	high
40646	openSUSE Security Update : libtiff-devel (libtiff-devel-1176)	Nessus	SuSE Local Security Checks	2009/8/20	2021/1/14	high
60623	Scientific Linux Security Update : libtiff for SL3.0.x, SL 4.x, SL 5.x on i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

偵測

搜尋 Plugin

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high