Ubuntu 13.04 USN-1832-1 Critical: LibTIFF App Crash Threat

ubuntu

May 21, 2013

LibTIFF could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

LibTIFF could be made to crash or run programs as your login if it opened a

specially crafted file.

Software Description:

- tiff: Tag Image File Format (TIFF) library

Details:

Emmanuel Bouillon discovered that LibTIFF incorrectly handled certain

malformed images when using the tiff2pdf tool. If a user or automated

system were tricked into opening a specially crafted TIFF image, a remote

attacker could crash the application, leading to a denial of service, or

possibly execute arbitrary code with user privileges.

Topics Covered

security advisory denial of service critical remote code execution application crash ubuntu libtiff

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  libtiff5                        4.0.2-4ubuntu2.1

Ubuntu 12.10:
  libtiff5                        4.0.2-1ubuntu2.2

Ubuntu 12.04 LTS:
  libtiff4                        3.9.5-2ubuntu1.5

Ubuntu 10.04 LTS:
  libtiff4                        3.9.2-2ubuntu0.13

In general, a standard system update will make all the necessary changes.