Red Hat Security AdvisoryRHSA-2009:1159
libtiff security update
Released 2009-07-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 libtiff-3.5.7-33.el3, libtiff-3.5.7-33.el3.i386, libtiff-devel-3.5.7-33.el3 +1
- Red Hat Enterprise Linux (v. 5 server) libtiff-3.8.2-7.el5_3.4, libtiff-3.8.2-7.el5_3.4.i386, libtiff-3.8.2-7.el5_3.4.ia64 +5
- Red Hat Enterprise Linux AS version 3 libtiff-3.5.7-33.el3, libtiff-3.5.7-33.el3.i386, libtiff-3.5.7-33.el3.ia64 +5
- Red Hat Enterprise Linux AS version 4 libtiff-3.6.1-12.el4_8.4, libtiff-3.6.1-12.el4_8.4.i386, libtiff-3.6.1-12.el4_8.4.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) libtiff-3.8.2-7.el5_3.4, libtiff-3.8.2-7.el5_3.4.i386
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libtiff-3.8.2-7.el5_3.4, libtiff-devel-3.8.2-7.el5_3.4, libtiff-devel-3.8.2-7.el5_3.4.i386
- Red Hat Enterprise Linux Desktop version 4 libtiff-3.6.1-12.el4_8.4, libtiff-3.6.1-12.el4_8.4.i386, libtiff-devel-3.6.1-12.el4_8.4 +1
- Red Hat Enterprise Linux ES version 3 libtiff-3.5.7-33.el3, libtiff-3.5.7-33.el3.i386, libtiff-3.5.7-33.el3.ia64 +3
- Red Hat Enterprise Linux ES version 4 libtiff-3.6.1-12.el4_8.4, libtiff-3.6.1-12.el4_8.4.i386, libtiff-3.6.1-12.el4_8.4.ia64 +3
- Red Hat Enterprise Linux WS version 3 libtiff-3.5.7-33.el3, libtiff-3.5.7-33.el3.i386, libtiff-3.5.7-33.el3.ia64 +3
- Red Hat Enterprise Linux WS version 4 libtiff-3.6.1-12.el4_8.4, libtiff-3.6.1-12.el4_8.4.i386, libtiff-3.6.1-12.el4_8.4.ia64 +3
Fixes 2 records
Priority MEDIUM 47
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) heigh…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.04152 · Published 2009-07-14 · Fixed CWE-189
Priority LOW 32
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0895 · Published 2009-07-01 · Fixed CWE-119
