sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] libtiff buffer overflow

From: Thomas Houssin <thomas.houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] libtiff buffer overflow
Date: Wed, 11 May 2005 01:05:37 +0200

Synopsis
========
The libTIFF library is vulnerable to a buffer overflow, potentially
resulting in the execution of arbitrary code.

Background
==========
tiff provides support for the Tag Image File Format.

Description
===========
libtiff is vulnerable to a buffer overflow when a malformed value is set
as BitsPerSample.
See http://bugzilla.remotesensing.org/show_bug.cgi?id=843 and
http://bugs.gentoo.org/show_bug.cgi?id=91584

Affected packages
=================
tiff in all grimoires is affected.
This is now fixed in devel, test and stable grimoire.

Resolution
==========
All tiff users should upgrade to the latest available version:
#scribe update
#cast -c tiff

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] libtiff buffer overflow, Thomas Houssin, 05/10/2005