Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Slackware 10.2: 2006-230-01 Critical: Libtiff Code Execution Risk

slackware
Calendar Grey August 18, 2006
Scroller Slackware
Recent libtiff updates address security vulnerabilities for Slackware users. The patches mitigate risks of system crashes and unauthorized code execution.
New libtiff packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues

Summary

Here are the details from the Slackware 10.2 ChangeLog: patches/packages/libtiff-3.8.2-i486-1_slack10.2.tgz: Patched vulnerabilities in libtiff which were found by Tavis Ormandy of the Google Security Team. These issues could be used to crash programs linked to libtiff or possibly to execute code as the program's user. A low risk command-line overflow in tiffsplit was also patched. For more details, see: https://www.cve.org/CVERecord?id=CVE-2006-3459 https://www.cve.org/CVERecord?id=CVE-2006-3460 https://www.cve.org/CVERecord?id=CVE-2006-3461 https://www.cve.org/CVERecord?id=CVE-2006-3462 https://www.cve.org/CVERecord?id=CVE-2006-3463 https://www.cve.org/CVERecord?id=CVE-2006-3464 https://www.cve.org/CVERecord?id=CVE-2006-3465 (* Security fix *)

Topics%20covered

Topics Covered

security advisory security update buffer overflow critical code execution slackware libtiff

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 9.0:
Updated package for Slackware 9.1:
Updated package for Slackware 10.0:
Updated package for Slackware 10.1:
Updated package for Slackware 10.2:
Updated package for Slackware -current:

MD5 Signatures

Slackware 9.0 package: 8b59a74e9a62bd5a6535658ff66b8d11 libtiff-3.8.2-i386-1_slack9.0.tgz
Slackware 9.1 package: 79406d875eaf03bd100bcf20b54f708c libtiff-3.8.2-i486-1_slack9.1.tgz
Slackware 10.0 package: 9238ef60318e9c31cbb831a42b0fafcb libtiff-3.8.2-i486-1_slack10.0.tgz
Slackware 10.1 package: 7f8ecbe32bb9a27ca360f77d49a5f897 libtiff-3.8.2-i486-1_slack10.1.tgz
Slackware 10.2 package: e2755a744fab6a838a867db2c12035d2 libtiff-3.8.2-i486-1_slack10.2.tgz
Slackware -current package: 4820279ae6acb71298c21393c8cdd310 libtiff-3.8.2-i486-2.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory security update buffer overflow critical code execution slackware libtiff

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg libtiff-3.8.2-i486-1_slack10.2.tgz