Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в libtiff
Опубликовано:28 августа 2013 г.
Источник:
SecurityVulns ID:13255
Тип:библиотека
Уровень опасности:
8/10
Описание:Уязвимости в различных утилитах.
Затронутые продукты:LIBTIFF : libtiff 3.9
 LIBTIFF : libtiff 4.0
CVE:CVE-2013-4244 (The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.)
 CVE-2013-4232 (Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted TIFF image.)
 CVE-2013-4231 (Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.)
Оригинальный текстdocumentMANDRIVA, [ MDVSA-2013:219 ] libtiff (28.08.2013)
 documentgeinblues_(at)_gmail.com, libtiff <= 3.9.5 integer overflow bug (28.08.2013)
 documentDEBIAN, [SECURITY] [DSA 2744-1] tiff security update (28.08.2013)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород