Ubuntu: 1498-2 Urgent: PNG Toolkit Remote Command Execution

ubuntu

July 5, 2012

The TIFF library could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

The TIFF library could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- tiff: Tag Image File Format (TIFF) library

Details:

It was discovered that the TIFF library incorrectly handled certain

malformed TIFF images. If a user or automated system were tricked into

opening a specially crafted TIFF image, a remote attacker could crash the

application, leading to a denial of service, or possibly execute arbitrary

code with user privileges. (CVE-2012-2088)

It was discovered that the tiff2pdf utility incorrectly handled certain

malformed TIFF images. If a user or automated system were tricked into

opening a specially crafted TIFF image, a remote attacker could crash the

application, leading to a denial of service, or possibly execute arbitrary

code with user privileges. (CVE-2012-2113)

Topics Covered

security advisory denial of service remote code execution ubuntu tiff library

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libtiff-tools                   3.9.5-2ubuntu1.1
  libtiff4                        3.9.5-2ubuntu1.1

Ubuntu 11.10:
  libtiff-tools                   3.9.5-1ubuntu1.2
  libtiff4                        3.9.5-1ubuntu1.2

Ubuntu 11.04:
  libtiff-tools                   3.9.4-5ubuntu6.2
  libtiff4                        3.9.4-5ubuntu6.2

Ubuntu 10.04 LTS:
  libtiff-tools                   3.9.2-2ubuntu0.9
  libtiff4                        3.9.2-2ubuntu0.9

Ubuntu 8.04 LTS:
  libtiff-tools                   3.8.2-7ubuntu3.12
  libtiff4                        3.8.2-7ubuntu3.12

In general, a standard system update will make all the necessary changes.