MDVSA-2010:145

Package name
libtiff
Date
2010-08-06
Advisory ID
MDVSA-2010:145
Affected versions
2009.0 x86_64 , MES5 i586 , 2009.1 i586 , 2009.0 i586 , CS4.0 i586 , 2008.0 x86_64 , CS4.0 x86_64 , 2008.0 i586 , 2009.1 x86_64 , MES5 x86_64

Problem description

Multiple vulnerabilities has been discovered and corrected in libtiff:

The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in
ImageMagick, does not properly handle invalid ReferenceBlackWhite
values, which allows remote attackers to cause a denial of service
(application crash) via a crafted TIFF image that triggers an array
index error, related to downsampled OJPEG input. (CVE-2010-2595)

Multiple integer overflows in the Fax3SetupState function in tif_fax3.c
in the FAX3 decoder in LibTIFF before 3.9.3 allow remote attackers to
execute arbitrary code or cause a denial of service (application crash)
via a crafted TIFF file that triggers a heap-based buffer overflow
(CVE-2010-1411).

Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3
allows remote attackers to cause a denial of service (application
crash) or possibly execute arbitrary code via a crafted TIFF file
that triggers a buffer overflow (CVE-2010-2065).

The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers
to cause a denial of service (out-of-bounds read and application crash)
via a TIFF file with an invalid combination of SamplesPerPixel and
Photometric values (CVE-2010-2483).

The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2
makes incorrect calls to the TIFFGetField function, which allows
remote attackers to cause a denial of service (application crash) via
a crafted TIFF image, related to downsampled OJPEG input and possibly
related to a compiler optimization that triggers a divide-by-zero error
(CVE-2010-2597).

The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly
handle unknown tag types in TIFF directory entries, which allows
remote attackers to cause a denial of service (out-of-bounds read
and application crash) via a crafted TIFF file (CVE-2010-248).

Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Updated packages

2009.0 x86_64

 a4dd4241cbf68a3800d955b56d96fc3a  2009.0/x86_64/lib64tiff3-3.8.2-12.3mdv2009.0.x86_64.rpm
 15dfa93a715fea30f87d47957d405614  2009.0/x86_64/lib64tiff3-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
 b90de01cd1f67c4b36a6a1a4478f40ae  2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdv2009.0.x86_64.rpm
 c39509d570099a3333dafb3c405be826  2009.0/x86_64/libtiff-progs-3.8.2-12.3mdv2009.0.x86_64.rpm 
 eb278dd00fcdba1a9a022b26b40b8f7b  2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

MES5 i586

 714eef6124b23c07d716a1088c961e8b  mes5/i586/libtiff3-3.8.2-12.3mdvmes5.1.i586.rpm
 4582318959daf3a89526f9e856d63b2a  mes5/i586/libtiff3-devel-3.8.2-12.3mdvmes5.1.i586.rpm
 a1ecf2254bbf472db01724e8a69a5648  mes5/i586/libtiff3-static-devel-3.8.2-12.3mdvmes5.1.i586.rpm
 6c67e9c5dab96a18ca157c60a61a04df  mes5/i586/libtiff-progs-3.8.2-12.3mdvmes5.1.i586.rpm 
 111eeb73e8c6893434da73e58726f8f2  mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm

2009.1 i586

 470a637b4fcccd4e177f39ecfc1193da  2009.1/i586/libtiff3-3.8.2-13.2mdv2009.1.i586.rpm
 a7adcfce77932c3d26100ed29a3a82a1  2009.1/i586/libtiff3-devel-3.8.2-13.2mdv2009.1.i586.rpm
 9699f07b73466260f2910bf714ce56c1  2009.1/i586/libtiff3-static-devel-3.8.2-13.2mdv2009.1.i586.rpm
 858cd94ead532044b99a40d793e3fbab  2009.1/i586/libtiff-progs-3.8.2-13.2mdv2009.1.i586.rpm 
 de1744758df19a271525d440d8e4016c  2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

2009.0 i586

 eca3a746733b5c1d336ecd334660f765  2009.0/i586/libtiff3-3.8.2-12.3mdv2009.0.i586.rpm
 88afdbf2d9f57d887e7d88c0a47aa7cb  2009.0/i586/libtiff3-devel-3.8.2-12.3mdv2009.0.i586.rpm
 42351524386fdf9f6f0db6a890f90d15  2009.0/i586/libtiff3-static-devel-3.8.2-12.3mdv2009.0.i586.rpm
 e2597dcb8dd52b9b9b89ed4a7e9a7457  2009.0/i586/libtiff-progs-3.8.2-12.3mdv2009.0.i586.rpm 
 eb278dd00fcdba1a9a022b26b40b8f7b  2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm

CS4.0 i586

 6464aada6be88ca85416e3522851ee1e  corporate/4.0/i586/libtiff3-3.6.1-12.9.20060mlcs4.i586.rpm
 00e9a5fa7a65674874338f6646996f84  corporate/4.0/i586/libtiff3-devel-3.6.1-12.9.20060mlcs4.i586.rpm
 b91ffa15bdc2bc7c5e8500a15594a0d7  corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.9.20060mlcs4.i586.rpm
 fb0919db56d53a7994022b27dc4a987f  corporate/4.0/i586/libtiff-progs-3.6.1-12.9.20060mlcs4.i586.rpm 
 3097d3095f2758050121bd7c1d274db2  corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

2008.0 x86_64

 ca769ee7dc0c489efa24b5bae4872324  2008.0/x86_64/lib64tiff3-3.8.2-8.3mdv2008.0.x86_64.rpm
 9437088dbe56fdeffe279200b1252bc0  2008.0/x86_64/lib64tiff3-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
 a36d2b3936381b0917169940751035e9  2008.0/x86_64/lib64tiff3-static-devel-3.8.2-8.3mdv2008.0.x86_64.rpm
 a754d8268b77e094829f46f4909253ed  2008.0/x86_64/libtiff-progs-3.8.2-8.3mdv2008.0.x86_64.rpm 
 1e9fce7b929a3abe76cf3a64984e2768  2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

CS4.0 x86_64

 320a589cc69ce0fbbdda5b0be55469d4  corporate/4.0/x86_64/lib64tiff3-3.6.1-12.9.20060mlcs4.x86_64.rpm
 164bbdf3291573b99304d785b63aa4d8  corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
 aaadd8deff51408f2d9ea7712202440e  corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm
 669f636420cf955a797ecea72c0f4aa7  corporate/4.0/x86_64/libtiff-progs-3.6.1-12.9.20060mlcs4.x86_64.rpm 
 3097d3095f2758050121bd7c1d274db2  corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm

2008.0 i586

 7f2c540142f1f0027e1af0bb5e5d6b9b  2008.0/i586/libtiff3-3.8.2-8.3mdv2008.0.i586.rpm
 2fe28407ec2158370391fde6671ce887  2008.0/i586/libtiff3-devel-3.8.2-8.3mdv2008.0.i586.rpm
 a63c74c604a64147e98b578fb14d8bb1  2008.0/i586/libtiff3-static-devel-3.8.2-8.3mdv2008.0.i586.rpm
 c6f6793532e54f0f429b0d7f2fb5cc53  2008.0/i586/libtiff-progs-3.8.2-8.3mdv2008.0.i586.rpm 
 1e9fce7b929a3abe76cf3a64984e2768  2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm

2009.1 x86_64

 e05c9cf64635f733396650b1140b5613  2009.1/x86_64/lib64tiff3-3.8.2-13.2mdv2009.1.x86_64.rpm
 002c8b1fff51881ac7181c14ec9b56b0  2009.1/x86_64/lib64tiff3-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
 f426223cfecb243643bcf46d6fbe5634  2009.1/x86_64/lib64tiff3-static-devel-3.8.2-13.2mdv2009.1.x86_64.rpm
 d66754ae9d5351c4747fcc6c5eb3f4dc  2009.1/x86_64/libtiff-progs-3.8.2-13.2mdv2009.1.x86_64.rpm 
 de1744758df19a271525d440d8e4016c  2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm

MES5 x86_64

 2908165921a479bd8765c5163857c1ba  mes5/x86_64/lib64tiff3-3.8.2-12.3mdvmes5.1.x86_64.rpm
 d5414e97a052e6bbec454d2984088b2c  mes5/x86_64/lib64tiff3-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
 9beda798ab71763f2cbc6c645f4a0eaa  mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm
 553379c5478d919c1388e13a08a39858  mes5/x86_64/libtiff-progs-3.8.2-12.3mdvmes5.1.x86_64.rpm 
 111eeb73e8c6893434da73e58726f8f2  mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm

References