| Main Archive Page > Month Archives > full-disclosure-uk archives |
[Full-disclosure] [PLSA 2008-31] Tiff: Denial of Service
From: Pınar Yanardağ <pinar_at_nospam>Date: Wed Aug 27 2008 - 05:26:36 GMT
To: pardus-security@pardus.org.tr
Pardus Linux Security Advisory 2008-31 security@pardus.org.tr
Date: 2008-08-27 Severity: 3 Type: Remote ------------------------------------------------------------------------
Summary
A vulnerability has been reported in LibTIFF, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise a user's system.
Description
The vulnerability is caused due to errors within the "LZWDecode()" and "LZWDecodeCompat()" functions in libtiff/tif_lzw.c. These can be exploited to cause a buffer underflow via a specially crafted TIFF file.
Affected packages:
Pardus 2008:
tiff, all before 3.8.2-9-3
Pardus 2007:
tiff, all before 3.8.2-8-7
Resolution
There are update(s) for tiff. You can update them via Package Manager or with a single command from console:
Pardus 2008:
pisi up tiff
Pardus 2007:
pisi up tiff
References
- http://bugs.pardus.org.tr/show_bug.cgi?id=8050
- http://security-tracker.debian.net/tracker/CVE-2008-2327
- http://secunia.com/advisories/31610
- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2327