Full Disclosure mailing list archives
[SECURITY] [DSA 2256-1] tiff security update
From: Thijs Kinkhorst <thijs () debian org>
Date: Thu, 9 Jun 2011 21:48:58 +0200 (CEST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2256-1 security () debian org http://www.debian.org/security/ Thijs Kinkhorst June 9, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tiff Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE ID : CVE-2009-5022 Debian Bug : 624287 Tavis Ormandy discovered that the Tag Image File Format (TIFF) library is vulnerable to a buffer overflow triggered by a crafted OJPEG file which allows for a crash and potentially execution of arbitrary code. The oldstable distribution (lenny) is not affected by this problem. For the stable distribution (squeeze), this problem has been fixed in version 3.9.4-5+squeeze2. For the testing distribution (wheezy) and unstable distribution (sid), this problem has been fixed in version 3.9.5-1. We recommend that you upgrade your tiff packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce () lists debian org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJN8SNCAAoJEOxfUAG2iX57PvoIAIWcMQRWNLngzDOA/jYyUWPR L4hgzden0VutPumP6WZ7QcZs64EAyipIBjbxgfdGVY3K7gk1TSSrxIeSEctWxC32 wuqfz25N63PfgYBjigoO4svIMAQuXLNZnmxXR+UsCQpMfG9I5aksZWvJx4LkPeBP 4of6ytsqEDxMmOI78FAqmmHpX3chr57YKTjMnpXNhY8WdpNB3sL21/nNi1gU/xbc s8enf0+GL+2qWesuBy9Hr56xn1OkAcZMIgfcK4dppby3FuL2pF4q7CDSXbih2hoS FOGbcz9EyAW4MKN1p4xMl7dcM/gnGiSuZ/GyLTEGq/HSYBaQjE4EjBl8LPoqW3I= =Zmzv -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [SECURITY] [DSA 2256-1] tiff security update Thijs Kinkhorst (Jun 10)