Red Hat Security AdvisoryRHSA-2006:0603
libtiff security update
Released 2006-08-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 libtiff-3.5.7-25.el3.4, libtiff-3.5.7-25.el3.4.i386, libtiff-devel-3.5.7-25.el3.4 +1
- Red Hat Enterprise Linux AS version 3 libtiff-3.5.7-25.el3.4, libtiff-3.5.7-25.el3.4.i386, libtiff-3.5.7-25.el3.4.ia64 +5
- Red Hat Enterprise Linux AS version 4 libtiff-3.6.1-12, libtiff-3.6.1-12.i386, libtiff-3.6.1-12.ia64 +5
- Red Hat Enterprise Linux Desktop version 4 libtiff-3.6.1-12, libtiff-3.6.1-12.i386, libtiff-devel-3.6.1-12 +1
- Red Hat Enterprise Linux ES version 3 libtiff-3.5.7-25.el3.4, libtiff-3.5.7-25.el3.4.i386, libtiff-3.5.7-25.el3.4.ia64 +3
- Red Hat Enterprise Linux ES version 4 libtiff-3.6.1-12, libtiff-3.6.1-12.i386, libtiff-3.6.1-12.ia64 +3
- Red Hat Enterprise Linux WS version 3 libtiff-3.5.7-25.el3.4, libtiff-3.5.7-25.el3.4.i386, libtiff-3.5.7-25.el3.4.ia64 +3
- Red Hat Enterprise Linux WS version 4 libtiff-3.6.1-12, libtiff-3.6.1-12.i386, libtiff-3.6.1-12.ia64 +3
Fixes 8 records
Priority HIGH 66
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.56311 · Published 2006-08-03 · Fixed CWE-119
Priority MEDIUM 48
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.14415 · Published 2006-05-30 · Fixed CWE-119
Priority MEDIUM 42
Unspecified vulnerability in the custom tag support for the TIFF library (libtiff) before 3.8.2 allows remote attackers to cause a denial of service (instability or crash) and execute arbitrary code via unknown vectors.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05771 · Published 2006-08-03 · Fixed
Priority MEDIUM 41
Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05316 · Published 2006-08-03 · Fixed CWE-119
Priority MEDIUM 41
Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05316 · Published 2006-08-03 · Fixed
Priority MEDIUM 40
Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream tha…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.0442 · Published 2006-08-03 · Fixed CWE-119
Priority LOW 39
TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an intege…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03531 · Published 2006-08-03 · Fixed CWE-189
Priority LOW 39
The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.02781 · Published 2006-08-03 · Fixed CWE-119
THREATIST.IORead the docs