Scientific Linux: SLSA-2014:0222-1 Moderate: libtiff Multiple Issues

Date: Thu, 27 Feb 2014 20:17:27 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: libtiff on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: libtiff security update
Advisory ID: SLSA-2014:0222-1
Issue Date: 2014-02-27
CVE Numbers: CVE-2010-2596
 CVE-2013-1961
 CVE-2013-1960
 CVE-2013-4231
 CVE-2013-4232
 CVE-2013-4243
 CVE-2013-4244
--

A heap-based buffer overflow and a use-after-free flaw were found in the
tiff2pdf tool. An attacker could use these flaws to create a specially
crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute
arbitrary code. (CVE-2013-1960, CVE-2013-4232)

Multiple buffer overflow flaws were found in the gif2tiff tool. An
attacker could use these flaws to create a specially crafted GIF file that
could cause gif2tiff to crash or, possibly, execute arbitrary code.
(CVE-2013-4231, CVE-2013-4243, CVE-2013-4244)

A flaw was found in the way libtiff handled OJPEG-encoded TIFF images. An
attacker could use this flaw to create a specially crafted TIFF file that
would cause an application using libtiff to crash. (CVE-2010-2596)

Multiple buffer overflow flaws were found in the tiff2pdf tool. An
attacker could use these flaws to create a specially crafted TIFF file
that would cause tiff2pdf to crash. (CVE-2013-1961)

All running applications linked against libtiff must be restarted for this
update to take effect.
--

SL6
 x86_64
 libtiff-3.9.4-10.el6_5.i686.rpm
 libtiff-3.9.4-10.el6_5.x86_64.rpm
 libtiff-debuginfo-3.9.4-10.el6_5.i686.rpm
 libtiff-debuginfo-3.9.4-10.el6_5.x86_64.rpm
 libtiff-devel-3.9.4-10.el6_5.i686.rpm
 libtiff-devel-3.9.4-10.el6_5.x86_64.rpm
 libtiff-static-3.9.4-10.el6_5.x86_64.rpm
 i386
 libtiff-3.9.4-10.el6_5.i686.rpm
 libtiff-debuginfo-3.9.4-10.el6_5.i686.rpm
 libtiff-devel-3.9.4-10.el6_5.i686.rpm
 libtiff-static-3.9.4-10.el6_5.i686.rpm

- Scientific Linux Development Team
lastline