Linux Security
    Linux Security
    Linux Security

    Debian: libtiff arbitrary code execution fix

    Date 24 Dec 2004
    6633
    Posted By Joe Shakespeare
    "infamous41md" discovered a problem in libtiff, the Tag Image File Format library for processing TIFF graphics files. Upon reading a TIFF file it is possible to allocate a zero sized buffer and write to it which would lead to the execution of arbitrary code.
    
    --------------------------------------------------------------------------
    Debian Security Advisory DSA 617-1                     This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                             Martin Schulze
    December 24th, 2004                     https://www.debian.org/security/faq
    --------------------------------------------------------------------------
    
    Package        : tiff
    Vulnerability  : insufficient input validation
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CAN-2004-1308
    
    "infamous41md" discovered a problem in libtiff, the Tag Image File
    Format library for processing TIFF graphics files.  Upon reading a
    TIFF file it is possible to allocate a zero sized buffer and write to
    it which would lead to the execution of arbitrary code.
    
    For the stable distribution (woody) this problem has been fixed in
    version 3.5.5-6woody2.
    
    For the unstable distribution (sid) this problem has been fixed in
    version 3.6.1-4.
    
    We recommend that you upgrade your libtiff packages immediately.
    
    
    Upgrade Instructions
    --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    --------------------------------
    
      Source archives:
    
        https://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6.woody3.dsc
          Size/MD5 checksum:      637 340b528a9a2735be4445813d3b31bebd
        https://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6.woody3.diff.gz
          Size/MD5 checksum:    36863 0fcfc242c2912f11ddfa61e5acf6a3b5
        https://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5.orig.tar.gz
          Size/MD5 checksum:   693641 3b7199ba793dec6ca88f38bb0c8cc4d8
    
      Alpha architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_alpha.deb
          Size/MD5 checksum:   141430 e2a4e5353b5190ba2f271b9e430f4d8a
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_alpha.deb
          Size/MD5 checksum:   105324 61006312584ef5098a6fedfb8b8eec5c
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_alpha.deb
          Size/MD5 checksum:   423230 c37b5c0a9f11461b31552091e84f1034
    
      ARM architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_arm.deb
          Size/MD5 checksum:   116942 7e670291be3f1e88a7cf87238c8f4dc8
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_arm.deb
          Size/MD5 checksum:    90626 462d7e4027442042d9794f833fb42776
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_arm.deb
          Size/MD5 checksum:   404272 021f714fb0ba6297a7edab37288d0d1d
    
      Intel IA-32 architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_i386.deb
          Size/MD5 checksum:   112074 31124799ab739639d42ba7d994305c04
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_i386.deb
          Size/MD5 checksum:    81192 ff56b894c1f3d992daa72156eebf1bb8
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_i386.deb
          Size/MD5 checksum:   386982 4520ae6f631c76558b9d2e519018f331
    
      Intel IA-64 architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_ia64.deb
          Size/MD5 checksum:   158772 8dca52e254f5169876bdda83d5a73e62
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_ia64.deb
          Size/MD5 checksum:   135576 67bf80f51715e09f59bdae774b5ad53b
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_ia64.deb
          Size/MD5 checksum:   446536 54c08823147ca27851c1bb1c29aeced7
    
      HP Precision architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_hppa.deb
          Size/MD5 checksum:   128308 e62fd69fdbf5dd6dc337347e907d341d
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_hppa.deb
          Size/MD5 checksum:   106956 296b0ead43581f15dee241d9c41141e2
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_hppa.deb
          Size/MD5 checksum:   420350 f1808003f1367691ea1d91227dfd9e09
    
      Motorola 680x0 architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_m68k.deb
          Size/MD5 checksum:   107296 96ff857cd9e55fd6353285eeb7df7c33
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_m68k.deb
          Size/MD5 checksum:    79934 38565385a51542dcfe6c2fb25da5ef50
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_m68k.deb
          Size/MD5 checksum:   380168 85a1ad91ded95885ff7a3e5d95f51d53
    
      Big endian MIPS architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_mips.deb
          Size/MD5 checksum:   124070 6dbd5984962bbbeb495cfee6c8dcb084
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_mips.deb
          Size/MD5 checksum:    87990 fc176880406aa7a7b1cc5a8c72f94dae
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_mips.deb
          Size/MD5 checksum:   410780 319dd3f620c98980e1af2768900a65d3
    
      Little endian MIPS architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_mipsel.deb
          Size/MD5 checksum:   123700 ea4c56022faf06f7f83b1f67d2098f98
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_mipsel.deb
          Size/MD5 checksum:    88360 8d5acf467a5e30e7a748d454e1de6722
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_mipsel.deb
          Size/MD5 checksum:   411336 a8d1830a5e13862ec418e4765d421c9f
    
      PowerPC architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_powerpc.deb
          Size/MD5 checksum:   116054 0d01da61ec3f6b9500d3f930f4f5f314
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_powerpc.deb
          Size/MD5 checksum:    89600 adcfaa660fb4892be2c07383e5e29e64
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_powerpc.deb
          Size/MD5 checksum:   402430 8e263f5531615f6a870ad83a8de1b56b
    
      IBM S/390 architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_s390.deb
          Size/MD5 checksum:   116884 e99840003f0b894d57ca73831019d151
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_s390.deb
          Size/MD5 checksum:    91924 afa7e1b5f6784102f46ff3b51c2e89eb
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_s390.deb
          Size/MD5 checksum:   395340 4ebcdeeab43bd13178e8eb27fea9ba2a
    
      Sun Sparc architecture:
    
        https://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6.woody3_sparc.deb
          Size/MD5 checksum:   132894 3819976028448bb9cee99fb0b9b197e4
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6.woody3_sparc.deb
          Size/MD5 checksum:    88714 31f53c25d338a8a44ae2c951d1c49221
        https://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6.woody3_sparc.deb
          Size/MD5 checksum:   397068 26af71d9e153480ffd79791794a5da86
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    ---------------------------------------------------------------------------------
    For apt-get: deb https://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and https://packages.debian.org/
    
    

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/49-tis-the-season-of-giving-how-have-you-given-back-to-the-open-source-community?task=poll.vote&format=json
    49
    radio
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"8","type":"x","order":"1","pct":27.59,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"6","type":"x","order":"2","pct":20.69,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"15","type":"x","order":"3","pct":51.72,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.