CVE-2011-0192

Summary

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.vupen.com/english/advisories/2011/0845
• http://support.apple.com/kb/HT4564
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
• http://support.apple.com/kb/HT4565
• http://www.vupen.com/english/advisories/2011/0599
• http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.587820
• http://www.securityfocus.com/bid/46658
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
• http://secunia.com/advisories/43934
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055683.html
• http://support.apple.com/kb/HT4566
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057763.html
• http://www.vupen.com/english/advisories/2011/0621
• http://www.vupen.com/english/advisories/2011/0905
• http://www.debian.org/security/2011/dsa-2210
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• http://blackberry.com/btsc/KB27244
• http://www.redhat.com/support/errata/RHSA-2011-0318.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
• http://secunia.com/advisories/43664
• http://www.vupen.com/english/advisories/2011/0551
• http://security.gentoo.org/glsa/glsa-201209-02.xml
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
• http://www.vupen.com/english/advisories/2011/0930
• http://support.apple.com/kb/HT4999
• https://bugzilla.redhat.com/show_bug.cgi?id=678635
• http://www.securitytracker.com/id?1025153
• http://support.apple.com/kb/HT5001
• http://support.apple.com/kb/HT4554
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
• http://secunia.com/advisories/44135
• http://www.vupen.com/english/advisories/2011/0960
• http://secunia.com/advisories/43585
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
• http://secunia.com/advisories/44117
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:043
• http://secunia.com/advisories/43593
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057840.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055240.html
• http://secunia.com/advisories/50726
• http://support.apple.com/kb/HT4581

References

• http://www.vupen.com/english/advisories/2011/0845
• http://support.apple.com/kb/HT4564
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
• http://support.apple.com/kb/HT4565
• http://www.vupen.com/english/advisories/2011/0599
• http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.587820
• http://www.securityfocus.com/bid/46658
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
• http://secunia.com/advisories/43934
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055683.html
• http://support.apple.com/kb/HT4566
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057763.html
• http://www.vupen.com/english/advisories/2011/0621
• http://www.vupen.com/english/advisories/2011/0905
• http://www.debian.org/security/2011/dsa-2210
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• http://blackberry.com/btsc/KB27244
• http://www.redhat.com/support/errata/RHSA-2011-0318.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
• http://secunia.com/advisories/43664
• http://www.vupen.com/english/advisories/2011/0551
• http://security.gentoo.org/glsa/glsa-201209-02.xml
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
• http://www.vupen.com/english/advisories/2011/0930
• http://support.apple.com/kb/HT4999
• https://bugzilla.redhat.com/show_bug.cgi?id=678635
• http://www.securitytracker.com/id?1025153
• http://support.apple.com/kb/HT5001
• http://support.apple.com/kb/HT4554
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
• http://secunia.com/advisories/44135
• http://www.vupen.com/english/advisories/2011/0960
• http://secunia.com/advisories/43585
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
• http://secunia.com/advisories/44117
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:043
• http://secunia.com/advisories/43593
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057840.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055240.html
• http://secunia.com/advisories/50726
• http://support.apple.com/kb/HT4581

• ←Previous
• Next→