Multiple vulnerabilities has been found and corrected in libtiff :

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327 (CVE-2009-2285).

Fix several places in tiff2rgba and rgb2ycbcr that were being careless about possible integer overflow in calculation of buffer sizes (CVE-2009-2347).

This update provides fixes for these vulnerabilities.

CVE-2009-2347 libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE) Not the same as last week's libtiff security issue ...

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of the tiff package fixes various integer overflows in the tools. (CVE-2009-2347)

Multiple vulnerabilities has been found and corrected in libtiff :

Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327 (CVE-2009-2285).

Fix several places in tiff2rgba and rgb2ycbcr that were being careless about possible integer overflow in calculation of buffer sizes (CVE-2009-2347).

This update provides fixes for these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The remote host is affected by the vulnerability described in GLSA-201209-02 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libTIFF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted TIFF       file with an application making use of libTIFF, possibly resulting in       execution of arbitrary code with the privileges of the user running the       application or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1159 advisory.

    - Fix buffer overrun risks caused by unchecked integer overflow (CVE-2009-2347)     Resolves: #507725
    - Fix some more LZW decoding vulnerabilities (CVE-2009-2285)     Resolves: #507725

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

GNOME 2.6.0: GNOME libtiff - library for reading and writing TIFF.
Date this patch was last updated by Sun : Sep/15/16

Several vulnerabilities have been discovered in the library for the Tag Image File Format (TIFF). The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2285     It was discovered that malformed TIFF images can lead to     a crash in the decompression code, resulting in denial     of service.

  - CVE-2009-2347     Andrea Barisani discovered several integer overflows,     which can lead to the execution of arbitrary code if     malformed images are passed to the rgb2ycbcr or     tiff2rgba tools.

A buffer overflow was discovered in libtiff which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with CCITT Group 4 encoding (CVE-2011-0192).

Additionally it was discovered that the fixes for CVE-2009-2347 and CVE-2010-2065 were incomplete for Mandriva Linux 2010.0 and 2010.2 and being resolved as well.

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

Tielei Wang and Tom Lane discovered that the TIFF library did not correctly handle certain malformed TIFF images. If a user or automated system were tricked into processing a malicious image, an attacker could execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libtiff packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Several integer overflow flaws, leading to heap-based buffer overflows, were found in various libtiff color space conversion tools.
An attacker could create a specially crafted TIFF file, which once opened by an unsuspecting user, would cause the conversion tool to crash or, potentially, execute arbitrary code with the privileges of the user running the tool. (CVE-2009-2347)

A buffer underwrite flaw was found in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a specially crafted LZW-encoded TIFF file, which once opened by an unsuspecting user, would cause an application linked with libtiff to access an out-of-bounds memory location, leading to a denial of service (application crash). (CVE-2009-2285)

The CVE-2009-2347 flaws were discovered by Tielei Wang from ICST-ERCIS, Peking University.

All libtiff users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, all applications linked with the libtiff library (such as Konqueror) must be restarted for the update to take effect.

GNOME 2.6.0_x86: GNOME libtiff - library for reading and writing T.
Date this patch was last updated by Sun : Sep/15/16

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
39849	Mandriva Linux Security Advisory : libtiff (MDVSA-2009:150)	Nessus	Mandriva Local Security Checks	2009/7/14	2021/1/6	high
39864	Fedora 11 : libtiff-3.8.2-14.fc11 (2009-7775)	Nessus	Fedora Local Security Checks	2009/7/20	2021/1/11	high
40646	openSUSE Security Update : libtiff-devel (libtiff-devel-1176)	Nessus	SuSE Local Security Checks	2009/8/20	2021/1/14	high
42991	Mandriva Linux Security Advisory : libtiff (MDVSA-2009:169-1)	Nessus	Mandriva Local Security Checks	2009/12/4	2021/1/6	high
62235	GLSA-201209-02 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/9/24	2021/1/6	high
67892	Oracle Linux 5 : libtiff (ELSA-2009-1159)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
107350	Solaris 10 (sparc) : 119900-18	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
44700	Debian DSA-1835-1 : tiff - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
52592	Mandriva Linux Security Advisory : libtiff (MDVSA-2011:043)	Nessus	Mandriva Local Security Checks	2011/3/9	2021/1/6	high
39788	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : tiff vulnerability (USN-801-1)	Nessus	Ubuntu Local Security Checks	2009/7/14	2021/1/19	high
39858	Fedora 10 : libtiff-3.8.2-14.fc10 (2009-7724)	Nessus	Fedora Local Security Checks	2009/7/20	2021/1/11	high
40344	CentOS 3 / 5 : libtiff (CESA-2009:1159)	Nessus	CentOS Local Security Checks	2009/7/23	2021/1/4	high
40653	openSUSE Security Update : libtiff-devel (libtiff-devel-1176)	Nessus	SuSE Local Security Checks	2009/8/20	2021/1/14	high
41320	SuSE9 Security Update : libtiff (YOU Patch Number 12470)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41430	SuSE 11 Security Update : libtiff (SAT Patch Number 1172)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
107853	Solaris 10 (x86) : 119901-17	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
42018	openSUSE 10 Security Update : libtiff-devel (libtiff-devel-6406)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high